Theme
securelabz.org

WE FIND
WHAT OTHERS
MISS.

API security research and penetration testing.
We start where attackers start. Anonymous. Unauthenticated.

Get in touch → Our services
30+
Confirmed findings
7+
Years experience
0
Data retained
kz@securelabz ~ passive recon
OWASP API Top 10BOLA / IDORGDPRSOC 2 Type IIISO 27001JWT / OAuth 2.0AWS S3 / IAMGraphQLMITRE ATT&CKNIST CSFBC-DRResponsible Disclosure OWASP API Top 10BOLA / IDORGDPRSOC 2 Type IIISO 27001JWT / OAuth 2.0AWS S3 / IAMGraphQLMITRE ATT&CKNIST CSFBC-DRResponsible Disclosure
Services

WHAT WE DO

01

API Security & Penetration Testing

OWASP API Top 10BOLAIDORJWT
02

GDPR & Compliance Audits

GDPRSOC 2ISO 27001
03

DPO as a Service

GDPRICODPA
04

Bug Bounty Consulting

HackerOneBugcrowdScoping
05

Training & Mentorship

API SecurityBug BountyOSCP Prep
06

BC-DR & Security Documentation

BC-DRNIST CSFEnterprise
Methodology

HOW WE WORK

01
Phase 01

Passive Recon

Anonymous. No account, no credentials. Public API flows, network traffic, DevTools.

02
Phase 02

Active Testing

Systematic across OWASP API Top 10. Auth bypass, rate limiting, cross-tenant isolation.

03
Phase 03

Compliance Mapping

Every finding mapped to GDPR, SOC 2 or ISO 27001. Audit-ready language.

04
Phase 04

Report & Remediation

Full PoC, CVSS scoring, compliance implications, remediation guidance.

Skills

TOOLS & TECH

Testing tools
🔍Burp Suite
🖥Nmap
📡Wireshark
📋Postman
⚡SQLMap
🎯Metasploit
🌐OWASP ZAP
🐧Kali Linux
Languages & scripting
🐍Python
💻Bash
🔧curl
📦boto3 / AWS
🧩GraphQL
📄REST APIs
Frameworks & standards
🛡OWASP Top 10
☁MITRE ATT&CK
📈NIST CSF
🔒ISO 27001
📋SOC 2
🇪🇺GDPR
Experience

TRACK RECORD

2026
Present
Security Researcher & Founder
SecureLabz
Independent API security research and penetration testing. Active responsible disclosures across enterprise SaaS, FinTech, RegTech and ATS platforms. Confirmed bounties paid.
2018
Present
Senior Product Support Engineer
Programmers Force / ShuftiPro
7+ years across SaaS, RegTech and FinTech. Tier II and III technical support. Security research methodology developed from systematic investigation. Clients include CivicPlus, RVshare, Zinc.work and Binance.
Ongoing
Responsible Disclosure Researcher
Independent
Active disclosures across B2B SaaS, ATS and FinTech platforms. Findings include cross-tenant BOLA, unauthenticated AWS credential exposure, IAM key leakage, GraphQL introspection and authentication bypass chains. Prior acknowledgments from Microsoft and multiple enterprise platforms.
Certifications

CREDENTIALS

APIsec University
API Security Fundamentals
APIsec University · 2024
Postman
API Fundamentals Expert
Postman Student Expert · 2024
Microsoft
Responsible Disclosure Acknowledgment
MSRC Hall of Fame
US B2B SaaS Platform
Bug Bounty Confirmed
Critical BOLA chain · 2026
About

WHO WE ARE

SecureLabz was built on one observation. Most penetration tests miss the most obvious things because they test from the wrong angle.

We start from the outside. Anonymous. Unauthenticated. We have found critical vulnerabilities in enterprise platforms used by globally recognised companies without ever logging in.

7+ years across API security, penetration testing, GDPR compliance and enterprise SaaS. Zero data retained. Zero affected individuals contacted.

  • BOLA, IDOR, Mass Assignment, Domain Takeover across active disclosures
  • SOC 2, ISO 27001 and GDPR compliance framework experience
  • Cloud investigation across AWS, Azure and GCP
  • Python, Bash, curl, Postman, REST and GraphQL
  • FinTech, RegTech and enterprise SaaS across UK, US and MENA
  • Arabic, English and Urdu. MENA, UK and APAC.
kz@securelabz ~ bola chain
# Phase 1: enumerate tenant scope
$ python3 enum_tenants.py --target [bucket]
[+] Tenant folders found: 2,893
[+] Object IDs extracted: 49,748

# Phase 2: cross-tenant resolution
$ curl -X POST /api/personal-details-by-ids
  -H "Authorization: Bearer [own-token]"

name : [target-user]
email : [target-email]
phone : [exposed]

[!] Cross-tenant BOLA. 49,748 records.
[+] Disclosed. Bounty confirmed.
Contact

GET IN TOUCH

We work with companies across the UK, USA and Gulf region. All enquiries treated with complete discretion.

@
hello@securelabz.orgPreferred for all enquiries
in
linkedin.com/company/securelabzSecureLabz on LinkedIn
www
securelabz.orgWebsite