Application security engineer. I break things on purpose, then help teams build them so they can't be broken the same way twice.

Website: abdallah-hammad.com  ·  LinkedIn: abdallah-hammad

Every case study on my website links back to one of these repositories: a full, client-identity-redacted technical write-up of the engagement, methodology, sanitized findings, and (where the engagement allows it) runnable tooling reproducing each vulnerability class against a synthetic lab target. See each repo's DISCLAIMER.md for exactly what's real and what's an illustrative reproduction.

• appsec-ai-saas-assessment: Prompt injection, insecure output handling, and excessive agency on an AI SaaS chatbot. 92% vulnerability reduction, prompt-injection paths eliminated.
• appsec-healthcare-ai-chain: A chained exploit: chatbot jailbreak to stored XSS to IDOR to platform-wide access control failure on a healthcare AI platform. 90% vulnerability reduction, chain eliminated.
• appsec-ai-workflow-secure-design: Secure-by-design review of an agentic AI workflow platform: privileged-path mapping and an action-authorization gate across 20+ integrations. 93% findings remediated, 70% reduction in privileged attack paths.

• appsec-webapp-privesc-assessment: A full penetration test: self-registered account to full admin privilege via missing server-side authorization. Includes the complete PDF report.
• appsec-fintech-transaction-security: API authorization gaps and transaction-integrity race conditions on a financial platform, with a runnable double-spend reproduction. 92% vulnerability reduction.
• appsec-ecommerce-scale-review: Pre-launch review of a 100+ endpoint e-commerce platform: coverage matrix, business-logic abuse cases, risk-ranked launch readiness. 94% vulnerability reduction.
• appsec-ai-companion-auth-hardening: Auth and session hardening on an AI companion platform, and how it became a standing security-ownership program, not just a fix list. 90%+ reduction in account-takeover risk.

• appsec-devprod-isolation-assessment: From a publicly reachable dev environment to a cross-environment credential pivot into production. MITRE ATT&CK mapped kill chain.

• appsec-multitenant-healthcare-isolation: Cross-tenant IDOR, query scoping, and cache bleed on a multi-tenant healthcare SaaS platform, closed with app- and database-layer defenses. 90% reduction in high-risk findings.

• appsec-e2ee-digital-legacy-review: Verifying a "zero-knowledge" claim technically on an end-to-end encrypted digital legacy platform, not just accepting it. 18 high/critical issues eliminated.

• appsec-edtech-secure-by-design: Threat model to traced security requirements to pre-launch verification, before a line of code shipped. 85-90% pre-launch vulnerability risk reduction.

Every repo documents a real engagement, redacted. Client names, real domains, and real data are never included. Any runnable demo target, payload, or tooling is an illustrative lab reproduction of the vulnerability class, not a working exploit against a live system. See each repo's own DISCLAIMER.md.