Tool · Open source
bookmark-path-finder
Finds hidden paths and API routes on any page.
Cyber & Product Security EngineerCo‑Founder at Raqyan
Moaaz Afifi
I build secure products and break them before attackers do.
- Git
- Docker
- Kubernetes
- AWS
- Linux
- Terraform
- Burp Suite
- OWASP
Where I've worked
I make sure software is built, shipped, and tested so attackers can't break it.
-
Present
Co-Founder & Product Engineer
Raqyan Co-founder
Running delivery from code to production, with security built in.
- Product delivery: own the release process.
- Product security: keep what we ship safe for customers.
- DevOps & DevSecOps: the CI/CD pipeline and its automated security checks.
-
Feb 2025 – Present
Cyber Security Consultant & Penetration Tester
GCC Part-time
Testing client apps like an attacker, then reporting the fixes.
- Penetration testing: web and mobile applications.
- Reporting: reproduction steps, impact, and the fix for every finding.
-
2023 – Present
Cyber Security Researcher
HackerOne Part-time
Finding flaws in live products through bug bounty programs.
- Bug bounty: public and private programs.
- Disclosure: one report was assigned CVE-2024-36436.
-
Jun 2025 – Aug 2025
Application Security Engineer
Robusta Technology Group (RTG) Full-time
Helping product teams ship without security holes.
- Assessments: reviewing features for vulnerabilities.
- DevSecOps: automated security checks in the pipeline.
-
Oct 2023 – Jan 2024
Offensive Security Engineer
Cybrany Part-time
Simulating attacks and researching new vulnerabilities.
Education
Computer Science & Engineering
Faculty of Electronic Engineering, Menoufia University
Volunteering
Cyber Security Core Member, IEEE Menoufia University Student Branch
Arts Committee Member, FEE Student Union
Client engagements
Brands I've worked with
Protect your revenue and your customers' trust
Attackers don't care how big you are. I look at your product the way they do, find what could cost you money or customers, and fix it before it becomes a crisis.
What's at stake
-
Customer data leak
Exposed records cost you customers, legal trouble, and your reputation.
-
Account takeover
Attackers log in as your users and drain balances, points, or data.
-
Payment & logic fraud
Flaws in checkout, coupons, or limits become direct financial losses.
-
Downtime & ransomware
Every hour offline means lost sales and broken promises to customers.
-
Third-party & supply chain
One vulnerable library or vendor can become your breach.
-
Failed security reviews
Enterprise customers ask for proof. Without it, the deal stalls.
What you get
Fewer surprises
Risks found and fixed before attackers find them.
Clear decisions
Findings ranked by business impact, in plain language for your team and leadership.
Faster deals
Evidence that helps you pass customer security reviews.
Full confidentiality
NDA-friendly. Findings are shared only with you.
How it works
- 01
Understand your business
What you sell, what you store, and what would hurt most.
- 02
Map the attack surface
Apps, APIs, cloud, and the people and vendors around them.
- 03
Test like an attacker
Real attack paths against what matters, not a generic checklist.
- 04
Fix, verify, retest
Clear fixes with your developers, then proof they hold.
Not sure where you're exposed?
Tell me about your product and I'll point out where the real risks are.
A product security engineer with a developer's background
I came to security from software development, so I read code, not just responses, and understand what the developer intended.
I work on both sides: shipping software and attacking it.
What I do
-
Product Security & DevSecOps
Automated security checks and secure defaults in the delivery pipeline.
-
Application Security
Secure code review and testing alongside developers.
-
Web & Mobile Penetration Testing
Web, API, and Android testing, with every finding verified and a clear fix.
-
Security Research & Bug Bounty
Finding vulnerabilities in live systems and disclosing them responsibly.
-
AI Security
Testing AI features for prompt injection, weak auth, and data exposure.
Security domains I cover
- Product security
- Application security
- DevSecOps & CI/CD
- API security
- Mobile security
- Cloud security (AWS)
- Kubernetes & container security
- Infrastructure-as-Code security
- Software supply chain (SBOM, SLSA)
- Threat modeling
- AI security
Things I've built and shipped
Research · Coordinated disclosure
CVE-2024-36436
Found and reported through coordinated disclosure.
Nothing here yet.
Research & write-ups
View all posts
EngineeringSecuritySep 14, 2026 · 2 min read
Fuzz the type, not just the value
Change a parameter's type, not just its value, to find authorization bugs.
Read article
SecurityDec 20, 2024 · 6 min read
From Comments to Command Execution: How an E-Book Platform Gave Me RCE
From stored XSS in comments to file upload to remote code execution.
Read article
SecurityDec 5, 2024 · 3 min read
From Frustration to Exploitation: How a Link Shortener Helped Me Bypass WAF
Getting past a WAF through the site's own link shortener.
Read articleCertifications
eCPPT
Certified Professional Penetration Tester
eLearnSecurity / INE
eWPTX
Web Penetration Tester eXtreme
eLearnSecurity / INE
eMAPT
Mobile Application Penetration Tester
eLearnSecurity / INE
eAIS
AI Systems Security Specialist
eLearnSecurity / INE
Let's work together
Available for new engagements
Hiring, consulting, training, or a security project. I read every message.
Email me directly
imooaaz@gmail.com