Hirohisa Tanaka

Joined as a Software Engineer Intern after being directly scouted by the CTO in October 2025.

Working across a broad range of areas, including web, mobile, and application security.

Responsibilities and experience include:

• Maintaining and improving an existing production codebase
• Refactoring and modifying legacy code
• Identifying and fixing multiple security vulnerabilities
• Developing and improving web application features
• Working across both frontend and backend systems
• Contributing to mobile application development
• Improving code maintainability while preserving existing behavior

Participated in a one-week frontend engineering internship in August 2026.

Developed the frontend of a CMS using React, TypeScript, TanStack Router, and Tailwind CSS.

Responsibilities and experience included:

• Implementing article, user, and administrator management screens
• Integrating the frontend with existing APIs
• Designing routing and data-loading flows with TanStack Router
• Implementing authentication-related frontend logic
• Building reusable UI components
• Implementing search, sorting, pagination, and view switching
• Writing tests for implemented features

Initially expected to work mainly on article-related pages, but completed the planned work ahead of schedule and expanded the implementation to additional areas of the CMS.

Worked as a Security Researcher with a focus on practical security education.

Responsibilities and experience included:

• Creating educational materials on SQL Injection
• Developing a sandbox environment for hands-on security training
• Designing exercises that allowed participants to safely learn common SQL Injection concepts
• Delivering a technical lecture and hands-on session
• Supporting participants during practical security exercises

Worked on an existing WordPress-based landing page as a freelance frontend engineer.

Responsibilities included:

• Modifying a custom WordPress theme
• Improving frontend performance and reducing page weight
• Implementing SEO improvements

Worked on the maintenance and infrastructure of existing landing pages.

Responsibilities included:

• Modifying three existing landing pages
• Migrating the web server environment from Apache to Nginx
• Configuring the new server environment and related infrastructure

Worked on website infrastructure migration and content recovery.

Responsibilities included:

• Migrating the company’s website to a new server environment
• Recovering lost website content after migration issues
• Restoring 5 pages
• Restoring 10 image assets

Worked continuously with the company for approximately one year as a freelance engineer and marketer.

Responsibilities included:

• Modifying and maintaining landing pages
• Supporting Google Ads campaigns
• Supporting Meta Ads campaigns
• Configuring and supporting LINE marketing tools
• Providing technical support for web-based marketing initiatives

Worked as a freelance RPA (Robotic Process Automation) engineer for an unlisted company, focusing on automating repetitive tasks and improving efficiency. Scope of work included:

• Developing and maintaining RPA scripts using Python and Java.
• Automating data entry and processing tasks
• Integrating RPA solutions with existing business processes

Reported and investigated a permission-handling issue in Cloudflare’s official MCP server.

Details:

• Found that list endpoints filtered down to zero results by OAuth scope returned 200 with an empty result, so no scope challenge was ever raised and agents reported the account as empty
• Measured the behavior against a real OAuth grant to distinguish permission-filtered lists from genuinely empty ones, and reported the finding with reproduction data (#302)
• Submitted an implementation with unit tests and end-to-end tests (#304)
• The maintainers’ fix (#305) was built on this report and branch, and has been merged

Continuous contributor to an open source Markdown editor built with React and Tauri.

Contributions included:

• Fixed a stored XSS vulnerability in the Markdown preview by introducing DOMPurify sanitization, while preserving KaTeX, Mermaid, and syntax highlighting output (#371)
• Fixed CSV paste handling so that quoted fields containing commas, escaped quotes, and newlines convert into valid Markdown tables (#475)
• Fixed header separator logic in HTML table conversion and added tests (#463)
• Fixed key-repeat and load-race bugs in the typing game and Konami code features (#462)
• Fixed a bug where the preview did not update when switching files (#509)
• Proposed feature requests including filename syntax in fenced code blocks and a separate preview window

Improved the reliability of the API client in LAPRAS’s official MCP server (#14).

Contributions included:

• Adding Zod schema validation for API responses
• Explicitly specifying application/json as the request Content-Type
• Adding error logging to improve debuggability
• Correcting typos in class names and return values

Reported a security vulnerability in a widely used open source e-commerce platform.

Details:

• Identified a CSV Injection issue in exported CSV data
• Reported it to IPA (Information-technology Promotion Agency, Japan) through the coordinated vulnerability disclosure process

Maintainer of the Discord bot used by the SF-Kosen community, involved from the initial project setup.

Contributions included:

• Setting up the TypeScript project and building the base command and action handling system (#1, #4)
• Implementing the ticket board feature (#5)
• Implementing custom voice channel creation with button and modal handling (#10, #11)
• Fixing an access control issue where unauthenticated users could join auto-created voice channels (#27)
• Fixing a permission problem on voice channel creation and adding logging for deletion failures (#28, #30)
• Standardizing action handling and improving type safety across the codebase (#9, #13)
• Leading an ongoing refactor toward a DDD-inspired architecture (#93, #94)