Ehtisham F.

I’m a Penetration Tester specializing in Web Applications, APIs, and SaaS Security. I manually find vulnerabilities that automated scanners often miss including IDOR/BOLA, broken authentication, authorization flaws, business logic vulnerabilities, SSRF, SQLi, XSS, and tenant-isolation issues. CRTO & CPTS certified | 5+ years offensive security | 49 completed projects I test web applications and APIs built with modern SaaS stacks, including **REST, GraphQL, OAuth, JWT, AWS, Supabase, and PostgreSQL**. My testing can include: • Web application penetration testing • API security testing (REST/GraphQL) • SaaS & multi-tenant security • Authentication & authorization testing • Business logic vulnerability testing • Cloud/backend security reviews • Internal network & Active Directory pentesting • Retesting after remediation You won't receive a report full of scanner output. I manually validate vulnerabilities, provide reproducible PoCs, explain the real-world impact, and give developers clear steps to fix them. Reports include CVSS severity, technical evidence, remediation guidance, and executive summaries** where needed. Testing can be aligned with OWASP, PTES, and NIST SP 800-115, with reporting suitable for security programs such as SOC 2 and ISO 27001. If you're launching a product, preparing for an audit, or want to know whether your application can actually withstand an attacker, I can test it from an attacker's perspective.