I build products, operate their infrastructure and break WordPress for fun.
Independent developer based in Vigo, Spain. Production platforms running on self-managed infra (VPS, K3s, Docker) and bug bounty hunting under the NyxSec handle.
I build products —for clients and for myself— from optimized WordPress platforms to FastAPI services managing electronic music festivals. That is the first layer.
On top of every product runs an infrastructure I also operate myself: VPS and cloud servers (Hetzner, AWS), Docker containers orchestrated with K3s or Compose, Traefik in front, observability with Grafana, Prometheus and ELK, deployments via GitLab CI/CD. That is the second layer.
And from operating so much WordPress I ended up hunting vulnerabilities on my own. Under the NyxSec handle I publish advisories on Wordfence: 6 assigned CVEs so far on plugins like Elementor, WPForms or Masteriyo LMS, with install bases ranging from hundreds of thousands to millions. That is the third layer.
These are not three parallel jobs: it is the same stack viewed from three altitudes. Operating teaches you to code better, coding teaches you to break things, breaking teaches you to operate.
02 · Selected work
Selected projects.
Curated cases, not exhaustive lists. Each one represents one of the layers of the stack.
01
security ai-agents
NyxSec — Bug bounty operation with an autonomous agent
Vulnerability hunting platform targeting WordPress plugins. An AI agent runs 24/7 on a dedicated VPS, communicates via Telegram and follows an in-house E2E validation protocol. Five assigned CVEs on plugins with install bases ranging from hundreds of thousands to millions of sites.
My own WordPress platform for online courses and reviews, with aggressive WPO: load time reduced from 8.2 s to 1.76 s and page weight from 3.09 MB to 1.55 MB. Self-hosted stack on own infrastructure with full observability.
Role
Developer and maintainer
Period
2024 — present
Stack
WordPressPHPDockerTraefikWP Super Cachefail2banElasticsearchGrafana
03
product devops
gofestivals — Electronic music festivals platform
Two domains under one brand identity (.es for Spain, .eu international) dedicated to the electronic music festival ecosystem. Includes radio.gofestivals, a curated radio layer with real-time ICY metadata, now live.
A set of specialized AI agents —security, web dev, home automation— running on self-hosted infrastructure, communicating via MCP and reporting through Telegram. Experimental by design, productive by method.
Role
Design and operation
Period
2025 — present
Stack
PythonClaude APIMCPDockerFastAPIOllamaHome AssistantRaspberry Pi 5
05
ai-agents product
tech-blog — Autonomous media platform with 9 AI agents
Autonomous platform that discovers news, detects trends, writes SEO-optimized articles and publishes them without human intervention. Nine specialized agents communicate via event bus, with a Chief Editor as quality gatekeeper and LLM cost telemetry per pipeline run.
Unified multi-channel conversational platform (WhatsApp Cloud API, Twilio, web chat) with multi-provider AI (Claude + GPT) and automatic human handoff. Built with Clean Architecture, 80% test coverage and a Next.js dashboard for real-time management.
wedding-page — Multi-tenant SaaS for wedding websites
Multi-tenant SaaS for creating wedding websites. Three subscription tiers with per-plan limits, Stripe for recurring payments and gifts, customizable templates and planned AI features for text generation and automatic color palettes. Deployed with Traefik and wildcard DNS.
Bug bounty hunting on WordPress plugins. Submissions to Wordfence and Patchstack following an in-house protocol: full E2E verification, framework defense check, no carrion (third-party discovered patches).
Handle: NyxSec
6.5
Medium
Visualizer: Tables and Charts Manager <= 3.11.14 — Missing Authorization
CVE-2026-24573
Falta de comprobación de autorización en las funciones renderChartPages y uploadData accesibles para usuarios autenticados con privilegios de suscriptor. Permite crear y modificar gráficos arbitrarios sin las capabilities requeridas.
plugin:Visualizer: Tables and Charts Manager for WordPresscwe:CWE-862date:May 27, 2026
Five Star Restaurant Reservations <= 2.7.16 — Unauthenticated Payment Bypass via PHP Type Juggling
CVE-2026-6498
Bypass de pago no autenticado mediante PHP type juggling en el parámetro 'payment_id'. La comparación laxa (==) permite a un atacante saltarse la verificación de pago enviando valores que coercionan al tipo esperado pero no coinciden con el valor real.
plugin:Five Star Restaurant Reservationscwe:CWE-697date:Apr 29, 2026
Falta de comprobación de autorización en endpoints accesibles sin autenticación, permitiendo a usuarios no autorizados modificar datos del plugin sin verificar permisos ni capabilities.
Falta de comprobación de autorización en una funcionalidad del plugin LMS, permitiendo a usuarios no autenticados acceder o modificar recursos sin las capabilities requeridas.
Falta de comprobación de autorización accesible para usuarios autenticados con privilegios bajos. Permite modificar recursos del plugin sin las capabilities adecuadas.
Contact Form by WPForms <= 1.9.9.3 — Missing Authorization
CVE-2026-32446
Falta de comprobación de autorización accesible para usuarios autenticados con privilegios bajos. Permite modificar recursos del plugin sin las capabilities adecuadas.
plugin:Contact Form by WPFormscwe:CWE-862date:Mar 7, 2026