Independent security researcher and penetration tester, founder of XSource Security. Christchurch, New Zealand.
- 10 published CVEs: Lenovo BIOS SMM (4), Mbed TLS (4), the CROSS post-quantum signature scheme (CVE-2026-41509, CVSS 9.8) and the vLLM inference server (CVE-2026-105758)
- 6 security fixes authored and merged upstream: Linux kernel (AMD NPU driver), oqs-provider and the SNOVA reference implementation
- 7 TF-RMM fixes merged with Reported-by credit
- OSCP+ · CPTS · CDSA · CWES · COAE · C-AI/MLPen · eCPPTv3 · eWPTXv3
Links:
- Disclosures, with public references: https://xsourcesec.com/disclosures/
- Write-ups: https://xsourcesec.com/blog/
- Profile: https://xsourcesec.com/eva-crystal/
Previously credited as iiviel.

