about

I’m Max Courchesne-Mackie, an offensive security engineer who likes to research interesting problems and break things. I started my career in the defense industry doing offensive security. Over the past decade that attacker’s mindset has carried me through red teaming, security architecture, and blockchain security, where I now lead security at Figment.

I’ve published eight security advisories, including four CVEs, for exposed tokens and secrets in CI/CD pipelines and developer tooling, in projects such as Wazuh, OpenEBS, and Pex, and I’ve been credited by the Apache and F5/nginx security teams. I’ve also released open-source offensive tooling, such as DuckDuckC2, a proof-of-concept command-and-control channel through DuckDuckGo’s image proxy, and patdown, a CLI that maps exactly what a GitHub token can do.

I also work on making entire industries harder to attack. As a member of the Blockchain Security Standards Council, I've co-edited the Node Operation Standard and the Blockchain Transaction Lifecycle Standard, a first-of-its-kind framework for ensuring that the transaction a user approves is the one that actually gets signed. I’ve contributed to the council’s Key Management Standard and General Security and Privacy Guidelines as well, and I put the same principles into practice with cryptographic attestation on every transaction our systems generate. I share what I learn on stage, most recently at DEF CON 34’s Red Team Village, NorthSec, Boston Blockchain Week, and the DeFi Security Summit, on topics ranging from attacking GitHub organizations to post-quantum cryptography.