Stepping Out From Behind the Curtains

I have to admit that, when I was younger, I used to get obsessed with things that today I would consider completely useless.

I would try to understand how people I admired had achieved things that I wanted to achieve too. And while looking for some kind of formula, I would copy behaviors that sometimes made sense — but most of the time, honestly, they didn’t.

It was almost like magical thinking.

If I wanted to play football as well as some famous player, maybe getting the same haircut as him would somehow make me a little better too.

It sounds ridiculous when I put it like that.

And it is.

The problem is that, as I grew older, I realized this behavior never really disappeared.

It just changed its shape.

When I got into cybersecurity, I started looking at the people I admired in this world and, once again, tried to copy some of their behaviors.

I wanted to dress and act like a “hacker”, a bug hunter, a security researcher, and so on.

Then I reached a major turning point in my life:

the moment I decided to become an entrepreneur.

The Hacker Behind the Curtains

There is an image of hackers that has been built over decades, especially by Hollywood.

Someone sitting in a dark room behind multiple screens, using a thousand VPNs and proxies so they can’t be discovered, seen, or identified.

Even profile pictures often follow the same idea: avatars, masks, characters, distorted images — anything that removes the real person behind the work.

For a long time, I think I absorbed part of this culture.

But this started to create a much bigger conflict when I became a father.

Because one day your kids ask a very simple question:

“Dad, what do you do?”

And you try to explain.

But at the same time, you have all these concerns about not saying too much about what you do, where you work, what you research, or who you are on the internet.

And eventually another question comes:

“But Dad, is what you do wrong? Then why can’t I tell people about it?”

That question hits differently.

Because explaining the difference between privacy, operational security, and simply living hidden from the world is not exactly an easy conversation to have with a child.

And that was when I started realizing something important:

I was destroying a trail that I should have been building.

A Research, a Nickname, and Almost Nobody Behind It

As a security researcher, I’ve been writing and publishing things since around 2019.

In 2024, one of my researches, “Another Vision for SSRF”¹, ended up among the nominations considered by PortSwigger for their Top 10 Web Hacking Techniques of 2024.

That was something really meaningful to me.

People read it.

People shared it.

People liked it.

But there was one small detail:

99% of them probably had no idea who I was.

They knew a nickname.

They knew a research.

Maybe they had read something else I wrote.

But they didn’t know the person behind it.

And for a long time, I thought that was exactly how things were supposed to be.

Until DEF CON 34.

Stepping Out From Behind the Curtains

This year, I went to DEF CON 34.

Yes, I was there.

And in some way, that was where I started stepping out from behind the curtains.

While walking through one of the hallways, I ran into James Kettle (@albinowax), a PortSwigger researcher and someone whose work I’ve followed and admired for a long time.

We said hello.

On the outside, I tried to keep it cool.

Inside, I was genuinely excited to be standing in front of a researcher I really admire.

With my broken English, we started talking.

At some point during the conversation, I decided to tell him that one of my researches had been selected by PortSwigger a couple of years before.

To my surprise, he reacted:

“Oh! Really?”

Then he told me that he had really liked the research.

He also mentioned that, during the voting, it had come very close to making the Top 10 that year.

And then he said something else that stayed with me: he really enjoyed the work coming from Brazilian security researchers.

Maybe for him it was just another conversation in a hallway at DEF CON.

For me, it wasn’t.

The Value of Being Recognized for What You Build

That conversation taught me something I probably should have understood much earlier.

Imagine spending years hiding yourself and, because of that, missing not only the opportunity to meet people you admire, but also the opportunity to discover that something you created actually reached them.

The things we write can travel across cities, countries, languages, and communities.

A research article published somewhere on the internet can eventually reach someone whose work you’ve been following for years.

There is something strange about building things that matter while completely erasing the person who built them.

And don’t get me wrong.

I’m not saying we should give up our privacy.

I’m definitely not ignoring the importance of operational security either — especially for people working in cybersecurity.

There are very good reasons to keep certain information private.

What I started questioning was something else:

At what point does privacy stop being protection and start becoming invisibility?

Building a Trail

Today, as an entrepreneur, I’ve been learning more and more about the importance of understanding the value of the things that are part of my life.

The value of my product.

The value of my work.

The value of my research.

The value of my faith.

The value of my family.

And, most importantly, the value of what I’m building.

For a long time, maybe I confused humility with invisibility, privacy with anonymity, and security with the need to always stay behind the curtains.

Today, I see things differently.

I don’t simply want to be seen.

That’s not the point.

I just want to have the courage to put my name behind the things I build.

I want my kids to know what their dad does.

I want to be able to meet someone in a hallway at a conference and say:

“I wrote that.”

I want to build a trail that, when I look back one day, I can recognize as mine.

Maybe stepping out from behind the curtains is exactly that.

It doesn’t mean giving up your privacy.

It doesn’t mean exposing everything.

And it doesn’t mean turning your life into a showcase.

It simply means allowing a real person to exist behind the work.

With a name, a story, values, mistakes, lessons learned, and a purpose.

I’m still learning how to do that.

But this time, I’ve decided not to completely hide myself in the process.

My thanks to James Kettle (@albinowax) and the entire PortSwigger team.

And also to every security researcher who shares knowledge and, sometimes without even realizing it, inspires someone else to keep building.

Peace!