I build software, then I break it.

I’m a Software & Application Security Engineer at Invygo, a Dubai-based startup, where I focus on the security and scalability of our services. I started as a full-stack developer, and that’s what makes the security work land: I know where the shortcuts get taken because I’ve taken them. Outside the day job, I hunt bugs through bounty programs and publish what I find.

• AI / LLM

  AI application pentesting

  Testing LLM-powered apps and agents the way an attacker would — manipulating prompts, tools and retrieved content to make the model leak data, bypass its guardrails, or take actions it shouldn’t — then hardening the integration around it.

  • Prompt injection
  • Jailbreaks
  • Data exfiltration
  • Excessive agency
  • Insecure output handling
  • OWASP LLM Top 10

• ICS / OT

  ICS pentesting

  Offensive testing of industrial control systems — the SCADA, PLCs and OT networks that run physical processes, where a finding isn’t a data leak but a stopped line. Trained through FOXGRID’s offensive industrial security course.

  Read the ICS writeup ↗
  • SCADA
  • PLCs
  • OT networks
  • Industrial protocols

• AppSec

  Application security

  Closed over 50 vulnerabilities at Invygo while maintaining its microservices architecture — finding the bug, then shipping the fix.

  • Burp Suite
  • OWASP ZAP

• Pentest

  Penetration testing

  Comprehensive penetration tests for multiple platforms, delivered as detailed reports with clear remediation steps — then worked through with the teams fixing them.

  • Burp Suite
  • Metasploit
  • Nmap

• DevSecOps

  Secure delivery

  Security practices integrated into CI/CD workflows on GitHub, following DevSecOps principles, so issues are caught before they ship.

  • GitHub
  • CI/CD

• Containers

  Container & cloud security

  Container image scanning and vulnerability management, plus secure container deployment strategies built with cross-functional teams.

  • Trivy
  • Clair
  • Docker
  • Kubernetes
  • AWS

1. 05 Apr 2025The Hidden Security Risk on Our Factory InfrastructureSCADAICS↗
2. 14 Mar 2025DevSecOps 101 — IntroductionDevSecOps↗
3. 11 Feb 2025Exploiting GraphQL Introspection to Leak Sensitive DataGraphQL↗
4. 15 Dec 2024From Django Debug Mode to Full SSRF-Driven Organization TakeoverSSRFDjango↗
5. 14 Nov 2024Dependency Confusion Attacks and Prevention: Full GuideSupply chain↗
6. UndatedYour Smart TV Isn’t Smart.IoT↗

• 2023 — Present

  Software & Application Security Engineer

  Invygo

  Dual role across engineering and application security: closed 50+ vulnerabilities, integrated security into CI/CD on GitHub, and built container scanning and vulnerability management with Trivy and Clair.

• 2020 — Present

  Security Research & Bug Bounty

  Freelance

  Helped secure assets for companies including Apple, TrendMicro and JustLife — through bug bounty programs and freelance penetration testing, with detailed reports and remediation support.

• 2021 — 2023

  Software Developer

  Fikralabs

  Led the engineering team delivering client projects — React and Next.js on the front, Node.js with SQL and NoSQL behind it.

• P-01Security↗LeakscloudLeakscloud is a monitoring solution for leaked credentials, built for startups without a SOC team.
• P-02Security↗SecrefySend one-time secret using a secure link which automatically expires.
• P-03Product↗DiabgestThe Diabgest application is a practical and comprehensive tool designed to help pregnant women with gestational diabetes manage their health and that of their baby.
• P-04Product↗ExploreMoroccoExploreMorocco is a user-friendly app designed to help travelers share and discover valuable tips and advice for exploring the beauty and culture of Morocco.

4 issuers6 credentialsAll verifiable