// found → fixed → verified
Your codebase, audited and fixed.
I'm a PhD in AI and cybersecurity. I audit web app codebases against the OWASP Top 10, pen-test your live endpoints, then fix what I find and hand back working code. Fixed scope. Fixed price. No retainer required.
scoped per project · fixed price, no hourly · 50% deposit
01 // the problem
You don't know if your app is secure — and finding out is expensive.
Pentest firms quote five figures and hand you a PDF. Automated scanners bury you in false positives and miss the bugs that actually matter. Meanwhile a client security questionnaire or a compliance deadline is sitting in your inbox with a date on it.
a pentest ends where your work begins.
false positives, and it still misses access control.
a questionnaire or audit just became your problem.
security was a "later" problem. later is now.
02 // coverage
What gets checked.
Security isn't one category. I audit against the three properties that define it — confidentiality, integrity, availability — because an app can be locked down and still be broken.
can anyone see data they shouldn't?
- injection: SQL, NoSQL, command, template
- broken access control: IDOR, missing role checks, horizontal escalation
- auth and session handling: weak tokens, fixation, insecure resets
- exposed secrets: keys and credentials in code and git history
can anyone change data they shouldn't?
- business logic flaws: price and quantity manipulation, workflow bypass
- race conditions: double-spend, duplicate submission
- input validation: unsanitized data reaching storage
- supply chain: unpinned dependencies, unverified lockfiles
can the app be degraded or taken down?
- slow queries and unbounded operations under real load
- missing rate limits on expensive endpoints
- dependencies with known DoS CVEs
- error handling that cascades instead of failing gracefully
Most audits stop at the first one.
03 // deliverables
Every finding, and the code that closes it.
- findings report
- every issue, severity-rated, file and line, mapped to OWASP/CWE
- fixed code
- patches delivered as a reviewable branch, grouped by severity
- verification
- every fix retested and confirmed closed
- hardening guide
- the checklist and config changes that keep it closed
No vague recommendations. Working code, with the holes closed.
04 // process
How an engagement runs.
Scope & access. Kickoff call: we agree exactly which repos, services and endpoints are in scope, and I quote a fixed price and timeline. We both sign it — that document is the contract.
Audit. Manual code review plus tooling across the codebase — injection, access control, auth and session handling, secrets, dependencies, misconfiguration — alongside live pen testing of your endpoints.
Report. Prioritized findings: what's wrong, where, why it matters, what it maps to. Critical issues reach you the day I find them, not at delivery.
Remediation & verification. I fix the confirmed issues and deliver them for review, grouped by severity so critical fixes merge first. Each one is retested and confirmed closed, then a walkthrough call to hand over.
05 // whoami
$ whoami
Dr. Kamal Bella. PhD in AI and cybersecurity. Based in Morocco. I build products, not just papers. What that means for your audit:
PhD-level background in cybersecurity. I find the flaws tools don't flag.
I don't hand you a list. I write the patch and prove it closed the hole.
fixed at the source, so the same class of bug doesn't come back.
- upwork earnings
- $50,000+
- rating
- 5.0 / 5.0
- total hours
- 1,000+
"Kamal was quick, got it 100% right away and responded immediately to requests. I would tell you he was perfect based on my interactions with him and I am massive pain in the ass."
Not a scanner. Someone who reads your code.
06 // pricing
Fixed price. No hourly.
Scope and price are agreed before anything starts. No creep, no meter.
- scope
- priced per project after a free scoping call
- basis
- codebase size, stack, and endpoint count
- timeline
- set at scoping, fixed
- deposit
- 50% — reserves your audit slot
- balance
- 50% — due before handover; fixes released on payment
07 // faq
Q: What access do you need?
A: Read access to the codebase, and permission to test the endpoints in scope — staging where possible, production only with written sign-off. Fixes come back as a reviewable branch or patch set that you merge yourself. I never need write access to your main branch.
Q: What languages and frameworks do you cover?
A: Any stack. The vulnerability classes are the same everywhere — injection, broken access control, auth handling, secrets, misconfiguration — and reading unfamiliar code carefully is the job.
Q: Is this a penetration test?
A: It's both halves. I read the source code, which finds logic and access-control flaws a black-box test can't see, and I test your live endpoints, which finds what only shows up at runtime. Most services do one or the other.
Q: Will this make me SOC 2 / PCI / HIPAA compliant?
A: I audit against whichever framework you're working toward and fix the technical gaps it requires. I'm not a certifying auditor, so I can't issue an attestation — but you go into that audit with the code-level findings already closed.
Q: What if you find something critical mid-audit?
A: You hear about it that day, before the report. Critical issues don't wait for a deliverable.
Q: What happens after the fixes ship?
A: You own the fixed code and the report outright. Re-audits after a major release, and ongoing review, are available separately. No obligation.
08 // apply
Check if it's a fit.
I take a limited number of audits and only ones I'm confident I can close out. First step is a short application. If it's a fit, you get a link to book a scoping call.
// message received
Thanks. I'll read what you sent and reply by email with a calendar link to book a scoping call.