About
I'm Marvin, a software engineer and penetration tester from Germany.
It started when I was a kid. I took things apart to see how they worked and what it took to break them. Putting them back together was harder, and it taught me more.
Then I discovered computers. I opened the source code of websites, changed things to see what would happen and built small pages of my own. That curiosity turned into the three things I do today: web development, software engineering and security testing.
Doing all three means I know how a product is built, how people use it and how it can be attacked. I don't do quick fixes or workarounds. I'd rather build it once and build it properly.
Path
- Childhood
Taking things apart
Wanting to know how things work, and how they break.
- Early years
The first page of code
View source, change something, watch what happens.
- 2011–14
Developer training
Where the hobby became a trade.
- 2014–22
Military service
Eight years. I learned to be precise and to take responsibility.
- 2022–25
B.Sc. Software Development
The theory behind what I'd been doing for years.
- 2025–now
Independent
Web, software and security for clients worldwide.
Values
- 01
Curiosity
I want to know how a thing works and how it breaks.
- 02
Attention to detail
I sweat the details most people only notice when they're wrong.
- 03
Honesty
You know the scope, the price and the findings. I don't dress any of it up.
Tools
Build, design, break. The tools change over the years, the reasons I use them don't.
- TypeScriptbecause 'undefined is not a function' is not a feature
- Reactinterfaces that stay fast as they grow
- Next.jsserver-rendered, quick on every device
- Astrothis very site
- Node.jsbackends that don't wake you at night
- Flutterone codebase, native feel
- React Nativemobile apps that share logic with the web
- PostgreSQLboring, reliable, fast
- Dockersame build everywhere
- three.jsthe device on the first page
- Adobe Illustratorlogos that hold from favicon to billboard
- Adobe Photoshopimages, retouched until nobody notices
- After Effectsmotion, timed before it becomes code
- Blenderobjects and light, before they turn into three.js
- Burp Suitewhere most web pentests start and end
- OWASP ZAPa second opinion on every web app
- Nmapknowing what's exposed before anyone else
- Nucleiknown issues, checked at scale
- ffufthe pages nobody meant to link
- Metasploitproof that a weakness is real, not theoretical
- BloodHoundwho can reach what inside a network
- Hashcathow long a password really holds
- Wiresharkseeing what really goes over the wire
- Kali Linuxthe workbench all of this runs on
Have a projectin mind?
Tell me what you're working on. I read every message and answer it myself.