Jamil Fayad

Independent developer · Lebanon & remote GCC delivery

Find the real weaknesses in your stack before someone else does.

I review a defined web, API or cloud attack surface and turn what I find into a prioritized, actionable report. Work directly with an independent security engineer in Lebanon, serving teams remotely across the UAE, Saudi Arabia and Qatar. Testing starts only once scope and written authorization are agreed.

Discuss your project

Start with the business problem.

A useful audit starts with one clearly bounded surface — a specific application, API, or cloud environment — and written authorization to test it. The goal is prioritized, fixable findings, not a generic checklist. Compliance requirements, if any, should be named upfront so the scope and report match what you actually need.

What we can scope

  • Web application and API penetration testing
  • Cloud configuration and access-control review
  • Authentication, authorization and session-handling checks
  • AI/LLM attack-surface review: prompt injection, model extraction and tool-permission abuse

What the delivery can include

  • A written scope and testing-authorization agreement before work starts
  • Hands-on testing against the agreed surface, documented as it happens
  • A report with severity ranking, reproduction steps and concrete fixes
  • A findings walkthrough and guidance for retesting after remediation

What shapes the project quote?

  • The size and type of the attack surface: web app, API, or cloud environment
  • Testing authorization, environment access and any compliance context
  • Report depth, retesting and the timeline for remediation support

Scope and boundaries

Scope, written testing authorization and the systems covered are agreed before testing starts. The audit assesses the agreed surface against the agreed criteria; it does not imply a compliance certification, a guarantee against future compromise or unlimited retesting.

Is this a useful first project?

A good first engagement names the system to test, who can authorize testing against it, and roughly when you need results. Production systems without a staging equivalent need extra care in scheduling and scope. This is a point-in-time assessment, not an ongoing monitoring service — ask if you need the latter.

Relevant engineering work

The CAI Security Framework is a personal research initiative organizing test plans, tool execution and evidence across application, cloud and AI/ML attack surfaces, including test cases for prompt injection, model extraction and adversarial attacks in a research setting. Run against OWASP Juice Shop, a deliberately vulnerable training application, it has reproduced findings spanning broken access control (registering with administrator privileges, reaching the admin section), broken authentication (resetting another user's password via a security-question flow), inconsistent error handling, and client-side injection (a DOM XSS via an iframe src="javascript:alert('xss')" sink). It demonstrates security engineering approach and methodology against a known benchmark, not a live client engagement or a compliance credential.

Explore the project portfolio →

Before we start

Does a security audit guarantee our systems are safe?
No. An audit identifies weaknesses found within the agreed scope and timeframe. It reduces risk by fixing what's found; it cannot promise protection against every future attack or guarantee compliance certification unless that is explicitly scoped and delivered by an accredited body.
What do you need from us before testing starts?
Written authorization naming the systems in scope, relevant account access or test credentials, and any constraints on timing (for example, avoiding peak business hours on a production system). We agree all of this before any testing begins.
Do you test AI/LLM systems specifically?
Yes, where it's a relevant part of the agreed scope — prompt injection, model extraction, tool-permission abuse and related AI-specific attack patterns, alongside standard web/API/cloud testing. This extends ordinary application security practice to AI-specific surfaces rather than replacing it.

Bring a workflow or application brief.

Share your company, current tools and the work you want to improve. Smaller projects are welcome. We can discuss fit, scope, integrations and a quote before work starts.

Describe your project