Hi, I'm Ehtesham. I break modern applications before attackers do.

I started reporting bugs on public programs in 2018, while I was still learning how real systems break rather than how they are drawn on a diagram. By 2021 it had become the thing I did most seriously, and it is where The Hidden Finds came from. I founded it to do this work under contract, with the depth a good bounty hunter brings and the structure a business actually needs.

Along the way I realized the vulnerabilities that matter are rarely about finding a bug from a checklist. They are about understanding how a system is supposed to work, and then seeing where that logic quietly breaks under someone who is not playing by the rules. That is why almost everything I do is manual. I use tooling to map a codebase or an attack surface, never to decide what is interesting. That judgment is the work, and it is the part a scanner cannot do.

My focus is SaaS applications and their APIs: authentication and authorization, multi tenant isolation, business logic, GraphQL, and the AI driven features that are now shipping faster than they are being secured. Most of my public writeups sit in exactly these areas, from cross tenant data exposure to chained API flaws that each looked harmless on their own.

Every engagement starts with scope agreed in writing. For code review I take read only access or an archive at a fixed commit. Each finding is reported with clear reproduction steps and the real impact spelled out, not a severity label with nothing behind it, and I stay reachable while your team fixes it. If you want the detail, the penetration testing, source code review and API security testing pages explain how each one runs.