Bug, Payment & Security Hunter Team

4-lane adversarial QA and security team. (1) bug-hunter: finds, verifies, and auto-fixes runtime/logic/security bugs in source via a Recon -> Hunter -> Skeptic -> Referee pipeline with checkpointed verification for large codebases. (2) payment-hunter: mobile in-app purchase domain (Apple StoreKit 2 / Google Play Billing) — subscription state machine, receipt verification, refunds/revocation, pending purchases, server-side notification (ASSN V2 / RTDN) edge cases. (3) web-payment-hunter: Paddle Billing web integration — webhook signature/timestamp, idempotency and event ordering, subscription lifecycle (trialing/past_due/paused/canceled), credit/entitlement granting, proration, MoR/tax. (4) attacker: active red-team that sends real PoCs against ISOLATED test resources to prove auth bypass, IDOR, injection, payment tampering, prompt injection, race conditions, etc., then delegates to the fixer and re-attacks with the same PoC to confirm the fix. The offensive lane is gated by a default-deny safety-guard that mechanically blocks production/real-user resources and only runs against authorized, isolated test targets (localhost / *-test / *-staging / debug builds / TEST_USER_* accounts).