Mostafa M.

Security researcher focused on payments, billing and access control. Ranked 31st all-time on Bugcrowd's paid leaderboard and #1 in Egypt, with 1,190 vulnerabilities found. Most of my findings sit where products take money and enforce limits: - prices and balances the client can change - subscriptions linked to the wrong account - race conditions that bypass caps - hidden or deprecated plans that still work - roles that can reach billing data they shouldn't I've hunted on Bugcrowd since 2016, full-time since 2024. Alongside that I take contracted work: - Grey-box penetration testing of web apps, APIs and mobile apps (React Native, Android, iOS) - Source-code security review - Vulnerability validation: confirming whether a CVE or a reported issue is actually exploitable Every engagement runs under written scope, with evidence for every finding and a clear report your team can act on. Available for fixed-price and ongoing non-exclusive work.