DREW RAINES

Solutions Architect in AI & Blockchain specializing in agentic payments, AI agents, LLMs, Web3, smart contracts, and decentralized systems, including 3+ years engineering production systems inside the U.S. Internal Revenue Service. Active independent security researcher with numerous paid bug bounties and research involving AWS and Asurion.
347.746.9540 • drdrewraines@gmail.com • Brooklyn, NY

Experience

Independent Cybersecurity & Security Researcher
Cybersecurity & Bug Bounty Research
2026 - Present
Independent vulnerability research spanning application security (AppSec), API and cloud attack surfaces, and smart-contract execution environments. Apply 10+ years of production engineering experience to threat modeling, exploitability assessment, and responsible disclosure.
  • Earned numerous paid bug bounties through independent vulnerability discovery and responsible disclosure; research includes Amazon Web Services (AWS), Asurion, and other enterprise programs.
  • Disclosed a production web-application vulnerability validated by a billion-dollar technology company's security team, receiving formal recognition from its CISO.
  • Received public AWS credit for CVE-2026-18953, a high-severity path-traversal vulnerability in AWS Transform MCP Server (CVSS 3.1: 8.6), remediated in version 0.1.5.
  • Perform security code review and abuse-case analysis of authentication and authorization controls, injection defenses, input-validation boundaries, and secrets management.
  • Evaluate smart-contract and autonomous-agent security invariants: mandate-scoped authorization, replay-resistant sequencing, budget enforcement, atomic settlement, and fail-closed execution.
  • Apply adversarial testing and failure-mode analysis to unauthorized invocation, replay, redirect handling, RPC outages, persistence failures, and upgrade risk; document exploitability and technical security judgments for responsible disclosure.
Solutions Architect in AI & Blockchain
REAPP
July 2026 - September 2026
Lead developer and sole author of the codebase for REAPP, a mandate-enforced agent payment protocol on Stellar.
  • Led Soroban smart contract implementation and x402/Stellar integration for simple and composite MandateRegistry contracts enforcing authorization, merchant and asset scope, budgets, expiry, replay-resistant sequencing, and atomic token transfers
  • Shipped source-verified Stellar testnet contract releases with deterministic builds, WASM hashes, pause and admin controls, and timelocked same-address upgrades that preserve contract IDs and storage
  • Built and published the TypeScript developer stack: @reapp-sdk/core, @reapp-sdk/stellar, @reapp-sdk/ap2, @reapp-sdk/express-middleware, and reapp-protocol-cli
  • Implemented signed AP2 mandate validation and fail-closed HTTP payment delivery with authenticated challenges, independent settlement verification, atomic fulfillment, immutable-result replay, and crash-safe no-second-payment recovery
  • Developed live consumer and fulfillment reference agents plus interactive Express, AP2, and CLI testnet workbenches demonstrating successful purchases and contract-enforced rejection after mandate budget exhaustion
  • Created 20 deterministic hackathon starter projects with reproducible archives, SHA-256 manifests, beginner-ready setup flows, and scenario-specific payment safety checks
  • Published REAPP NETWORK, a 50-page, source-backed field guide covering the architecture, protocols, authorization, security, implementation, and merchant-readiness requirements of agentic payments
  • Established threat models, failure drills, adversarial tests, and continuous gate checks covering unauthorized callers and upgrades, overspend, expiry, replay, redirects, RPC outages, and store failures
Solutions Architect
Weave Cloud
June 2023 - June 2026
Weave is a Serverless Cloud Platform enabling developers to create AI Agents, DAG Workflows, and APIs using low-code edge compute functions
  • Implemented web3 blockchain node integrations including Starknet ArgentX Wallet, Contract Declaration/Deployment, DeFi Llama, Chainlink Functions, Space and Time, Helius (Solana), and Solidity Compiler
  • Developed Block Broadcast system enabling users to create apps and listen to on-chain emitted events
  • Designed and implemented Tally AI algorithms for enhanced data processing
  • Conducted R&D initiatives for emerging blockchain and AI technologies
Solutions Architect
Just Peachy
January 2023 - June 2023
Enterprise blockchain automation and AI agent platform
  • Co-built an MCP-style blockchain tool server with two collaborators, beginning in January 2022, before MCP's public launch.
  • Architected Digital Workers, a Python agent system with memory, skill management, orchestration, and multi-tenant services.
  • Used smaller language models in Docker containers to generate smart contracts and deploy them across supported blockchains, returning task results to a coordinating LLM for the final response.
  • Presented the working prototype at ETHDenver in February 2023, demonstrating automated NFT marketplace deployment across multiple blockchains.
Chief Executive Officer
Boulevard.Social
March 2022 - January 2023
Decentralized social media platform with token-gated features and NFT marketplace
  • Built comprehensive infrastructure including Web3Auth integration for decentralized authentication
  • Implemented token-gated memberships and pay-per-purchase functionality in truly decentralized ecosystem
  • Developed NFT marketplace with gallery workflow for artists within user feeds
  • Engineered AI server to facilitate content commerce and recommendations
  • Created blockchain node listener and indexer to track transactions and deliver push notifications
Chief Technology Officer
Mad Oath
April 2021 - March 2022
Web3 gaming studio developing blockchain-powered gaming experiences
  • Led blockchain smart contract development for web3 gaming applications
  • Developed proprietary BlockRunner (Node Listeners and Cached Blockchain Indexers) and CARVE Minting Engine
  • Built NFT Dutch Auction Marketplace for the FireSky gaming platform
  • Created NFT Utility layer on Terra Blockchain enabling ticket borrowing/lending with ownership verification
  • Developed one of the first NFT Marketplaces on XRPL mainnet
  • Architected multichain NFT minting infrastructure across Avalanche, Polygon, and Ethereum
  • Managed all cybersecurity and smart contract auditing processes
  • Organized multiple industry hackathons sponsored by the company
Computer Science Instructor
Tom's River Regional School District
July 2020 - July 2024
  • Taught programming languages including HTML, CSS, JavaScript, Swift, and Python to junior high and high school students
  • Introduced students to industry services such as WordPress and AWS
  • Developed comprehensive curricula, lectures, projects, and assignments
Chief Technology Officer
Terminal Development
February 2019 - July 2020
  • Directed all IT services including cybersecurity, web development, database architecture, and iOS development
  • Designed and deployed multiple iOS applications: KeegansList (SXSW event aggregator), NextBlock (blockchain conference networking), Triple D Life (interactive restaurant mapping)
  • Built backend systems using MySQL and PHP/Python for REST API endpoints
  • Implemented AWS Lambda functions with API Gateways connecting to RDS instances
Lead Developer
Cannin
January 2018 - February 2019
  • Developed online investment monitoring tools for cannabis industry
  • Created iOS application interfacing with existing web services
  • Implemented stock quote functionality using Alpha Vantage API
Software Developer, IRS Federal Systems
Citizant • IRS, U.S. Department of the Treasury
Jul 2013 - Nov 2016
Developed and maintained IRS applications as a federal contractor with Citizant, working within FISMA, NIST 800-53, IRS Internal Revenue Manual controls, and formal change-management processes.
  • Developed and maintained the Branded Prescription Drug (BPD) application using Java and Spring MVC to support pharmaceutical fee assessments under the Affordable Care Act and reconcile manufacturer sales data across Medicare, Medicaid, VA, DoD, and TRICARE.
  • Delivered production fixes and maintenance for two IRS web services written in C#.
  • Co-developed a WPF/.NET replacement for a legacy IRS web-service application.
  • Built a business-rules application using Drools and Guvnor to implement and manage rules-based processing.
  • Authored technical white papers on Drools, JRebel, Big Data, and AngularJS to support technology evaluation.
  • Completed a federal background investigation for Public Trust access to IRS systems and Sensitive But Unclassified (SBU) data.

Publications

Drew Raines • Coordinated Vulnerability Disclosure • August 2026
AWS / GHSA-66mr-jr63-2jgw • High severity (CVSS 3.1: 8.6)
Publicly credited by AWS for coordinated disclosure of a path-traversal vulnerability enabling arbitrary file writes outside the intended working directory, with potential local code execution. Fixed in version 0.1.5.
Zhang, Y., Raines, A., Flowers II, R. A.
"Solvent-Dependent Chemoselectivities in Additions of β-Carbonyl Imines to Allyltrimethylsilane with CTAN."
The Journal of Organic Chemistry, 69(19): 6267-6272 (2004)
Zhang, Y., Raines, A., Flowers II, R. A.
"Solvent-Dependent Chemoselectivities in Ce(IV)-Mediated Oxidative Coupling Reactions."
Organic Letters 5(13): 2363-2365 (2003)

Academic Honors & Awards

Jeanette & Joe Dennis Scholarship
Texas Tech University • Department of Chemistry & Biochemistry
2005–2006 • Department announcement
President's List
Texas Tech University
Fall 2002 • Spring 2003 • Fall 2003
Dean's List
Texas Tech University
Spring 2005
Honors College Graduate — With Honors
Texas Tech University
2006
Cum Laude — B.S. Microbiology
Texas Tech University
2010
Cum Laude — B.S. Chemistry
Texas Tech University
2006

Selected Projects - 6 shipped products

AI & Applied Systems

ChainLens - AI Crypto Due Diligence Agent
Institutional-grade crypto due diligence in seconds. Multi-agent AI performs parallel analysis: smart contract security, whitepaper legitimacy, tokenomics sustainability. Multi-chain (ETH, Base, Arbitrum, Polygon, Solana).
chainlens.space • GitHub • Live
ReelPhysics - AI Movie Physics Roaster
Analyzes movies scene-by-scene, roasts impossible physics with actual formulas. 705+ movies analyzed. Currently used in a junior high school physics curriculum.

Cybersecurity

ZeroDayAI - AI Cybersecurity Scanner
Comprehensive web vulnerability assessments covering SSL/TLS, HTTP headers, injection vulnerabilities, and hidden endpoints, with HackerOne, Bugcrowd, and Synack payout estimates.
Sweep - WordPress Malware Detection & Automated Cleanup
One-click malware remediation for WordPress. Two-stage funnel: remote scan (no install, free) detects visible threats via HTML analysis, then single-file PHP agent enables deep filesystem scanning and automated cleanup. Detects obfuscated backdoors, eval chains, crypto miners, credential leaks, shell families (c99, r57, wso), image header backdoors, hook hijacking, and 40+ threat signatures.
Live

Mobile & Browser Extensions (Published)

Lovers - Apple Watch Proximity App
Real-time proximity tracking for couples. Anonymous pairing code, no accounts. Live distance display, haptic feedback at thresholds. Privacy-first. Published on App Store.
NoBuffer - Chrome Extension for Buffer-Free Streaming
Real-time video stream monitoring that warns about buffering before it interrupts. Analyzes buffer health, throughput, quality degradation. 100% local processing. Published on Chrome Web Store.