5theses
Supervision
I advised Saarland University theses on TLS/X.509 fuzzing, injection testing, property-based testing, and program repair. One project led to an ISSTA 2025 paper.
About
From Seville to Saarbrücken.
Education, research roles, and the work that came out of them.
Researcher in software testing and security.
I began as a student researcher in Seville, building software product line tools at the University of Seville and working on optimization problems at Universidad Pablo de Olavide. In October 2023, I moved to Saarbrücken for my PhD with Andreas Zeller at CISPA.
Since then, I have worked on generating tests for complex inputs and protocol interactions. At the Max Planck Institute for Security and Privacy, I studied how input features affect fuzzing coverage; that work informed later feature-focused testing.
At a glance
10PublicationsPeer-reviewed papers & tutorial 66CitationsGoogle Scholar $70kFunding I raisedUSD · My research 6Security advisories & reports4 CVEs · 2 other reports 8Research institutionsInstitutions I’ve worked with 174GitHub starsAcross my public repositories 202k+Software downloadsAll time · packages & releases 4Merged external fixesBug and security PRs
Repository stars, PyPI and GitHub packages, and release assets checked 4 November 2026.
My path so far
Where I’ve been.
Research highlight dates mark publication or the latest preprint revision.
- 2018–2022
BSc in Software Engineering
University of SevilleI studied in the English-language programme and began working as a student researcher in David Benavides’s Diverso Lab in January 2022. There I worked on software product lines and built WebSPL. I earned three Matrículas de Honor, a limited distinction for outstanding results in individual courses. My WebSPL thesis received an honors distinction, and I was selected to present the work at JISBD 2022, a leading Spanish software engineering research conference.
Read the WebSPL paper ↗ - 2022–2023
MSc in Software Engineering
University of SevilleI kept working in Benavides’s group and took a second student researcher role at Universidad Pablo de Olavide, studying mathematical heuristics and optimization. I also collaborated with Jordi Cabot, then at LIST and affiliated with the University of Luxembourg, on XatkitSPL. My master’s thesis received the top honors distinction, and I was selected to present our XatkitSPL work at JISBD 2023.
Read the XatkitSPL paper ↗ - Oct 2023–present
PhD in Computer Science
Saarland University · CISPAI joined Andreas Zeller at CISPA to study how to generate tests for complex inputs. I started Fandango and worked on distribution-aware, constraint-guided generation, XML injection tests, and personalized fuzzing. I also continued a graph-optimization collaboration with Universidad Pablo de Olavide.
- A JSON proof of concept steered age and budget values toward chosen distributions while respecting value constraints. It demonstrated the idea on 1,000 inputs; bug-finding gains were left for future work.ISSTA 2024 doctoral symposium ↗
Gave grammar-based tests a controllable input distribution.
- Our MATCOM paper formulates the k-weighted problem and evaluates heuristic solvers. In its unweighted special case, one iterated-greedy method reached comparable solutions in about half the comparison method’s computation time.MATCOM journal article ↗
Extended dominating-set optimization to weighted graphs.
- XAVIER generates attack inputs from WSDL-derived grammars. In an early-draft comparison on eight public WSDLs, it covered specified functionality comparably to SoapUI Pro.ISSTA 2025 XAVIER paper ↗
Turned web-service contracts into XML injection tests.
- Our case study described binary UBX messages with a grammar and domain-specific constraints, including legal values and deliberate NaN or infinity cases. The module acknowledged the legal messages and rejected the invalid ones in this run; no vulnerability was reported.ISSTA 2025 GNSS short paper ↗
Tested a real GNSS module with tailored edge cases.
- Across five benchmark formats, Fandango produced inputs 29–1,355× faster than the symbolic solver ISLa while 99.27–100% of outputs were accepted by parsers.ISSTA 2025 Fandango paper ↗
Made complex, valid test inputs faster to generate.
Jan 2026–present · CISPABack at CISPA, I continued the PhD with Andreas Zeller. The work since then has extended language-based testing to stateful protocol conversations, highly constrained inputs, and feature-focused test suites.
- Interaction grammars model messages and their changing state for protocols including SMTP, DNS, and FTP. In one FTP case study, Fandango reached 80.3% statement coverage in about 14 minutes; AFLNET reached a median 69.6% after a day.Protocol testing preprint · revised version ↗
Generated complete, stateful protocol conversations.
- The methods in our FSE tutorial had already been taught at the RIO Summer School to more than 100 participants, including grammars, constraints, and stateful protocol testing.FSE 2026 tutorial ↗
Brought language-based testing into hands-on teaching.
- Fandango-RS compiles grammars into Rust and uses multi-objective search. In the revised preprint’s constrained C-subset study, it generated 877 valid programs in about a minute where the earlier approach produced none. Its reported 3–4-order speedup concerns core operations.Fandango-RS preprint · v3 ↗
Made highly constrained compiler tests feasible.
- Compás turns a format specification into feature-specific test sets. Across ten formats, one or two focused sets retained the full suite’s aggregate line coverage; on average, every focused input reached its intended code region versus 26% under unfocused generation.ASE 2026 Compás paper ↗
Focused test suites on features without losing measured coverage.
Teaching & supervision
What I’ve taught.
My research also lives in courses, thesis projects, and tutorials that other people can use.
207students
Security Testing
As a teaching assistant for the advanced course, I helped design exercises, projects, and exams on fuzzing, static analysis, and vulnerability discovery.
353pages
Fuzzing with Fandango
I co-authored and co-taught the open tutorial and reference guide. Its methods also reached more than 100 participants at the RIO Summer School.
Read the guide ↗Training.
- 2024TAROT Summer School
Software testing, verification, and validation · University of Bergamo
- 2024Fuzzing and Software Security Summer School
National University of Singapore
- 2024Scientific Writing I & II
CISPA
- 2024Cybersecurity Skills
National Institute of Cybersecurity
- 2024Project management and pitch coaching
Impulsplus · Beth Susanne
Service.
- 2026Artifact evaluation
ASE and ISSTA
- 2026Tools and Datasets Track
ASE
- 2026Reviewer
ACM Transactions on Software Engineering and Methodology
- 2025Website chair
SBFT 2026
- 2024Reviewer
Journal of Systems and Software
Talks & presentations
Talks on the map.
Places where I’ve presented research and tools, from SISTEDES in Spain to testing conferences around the world. Pick a city to see the talks.
10 cities · 13 talks
Santiago de Compostela · 42.9° N / 8.5° W01 / 10Talk stop · 2022
Santiago de Compostela.
Spain
- SISTEDES / JISBD 2022WebSPL: automatic website generation with software product lines ↗
02 / 10Talk stop · 2023
Ciudad Real.
Spain
- SISTEDES / JISBD 2023Optimizing chatbot generation with software product lines ↗
03 / 10Talk stop · 2023
Madrid.
Spain
- GRAFO VI Workshop 2023Heuristic algorithms for weighted dominating sets ↗
04 / 10Talk stop · 2024
Vienna.
Austria
05 / 10Talk stop · 2025
Trondheim.
Norway
06 / 10Talk stop · 2025
Seville.
Spain
- INNOSOFT 2025Research abroad and Ph.D. life
07 / 10Talk stop · 2026
Bern.
Switzerland
08 / 10Talk stop · 2026
Daejeon.
South Korea
09 / 10Talk stop · 2026
Montréal.
Canada
10 / 10Talk stop · 2026
Munich.
Germany
Philosophy & interests
What matters to me.
01
Open work
Research should leave something other people can run, inspect, and build on. I publish tools and experiments with that in mind.
02
Ideas across fields
I like working with people who see the same problem from software engineering, formal methods, or security. Those conversations change the tools I build.
03
Hard systems
I’m interested in testing systems where simple input generators fall short: structured formats, stateful protocols, and AI systems that need to behave reliably in practice.