# Md. Jony Hassain

Md. Jony Hassain shares guidance on web application security and penetration testing, with a focus on risks to SaaS, startup, and e-commerce businesses.

- Profile: https://b2binfluencer.marketing/creators/md-jony-hassain/
- LinkedIn: https://www.linkedin.com/in/md-jony-hassain
- LinkedIn followers: 639
- Topics: ecommerce, supply-chain, startup, software-supply-chain-security
- Based on 18 dated posts, latest 2026-09-29

## Summary

They are most useful for web application security and penetration testing guidance for SaaS, startup, and e-commerce businesses.

- Best for: A B2B SaaS company seeking an authorized web application penetration test before launch or an enterprise security review.
- Not for: A sponsorship campaign needing a published media product, guaranteed reach, and a fixed content package.
- Check first: Ask for a sample client report and confirm scope, price, timing, deliverables, and confidentiality.

### Takeaways

- A negative deposit created an invalid balance, later deposits failed to correct it, checkout still worked.
- Authentication does not guarantee authorization; a logged-in user may reach another account or admin action.
- Design security in rather than patching bugs after release.

## Main ideas

- **Attackers often use a system differently than intended rather than break it**: The material's most-developed argument is that serious flaws hide in business logic. A site can be technically secure yet let users bypass controls, misuse workflows, or access actions they should not. Interface limits are not validation: a server can accept an input as a number without checking whether the resulting state makes sense. Md. Jony Hassain recommends strict server-side input validation and checking the integrity of an account's state before any update, rather than trusting what the front end allows.
- **Being authenticated is not the same as being allowed**: Md. Jony Hassain distinguishes authentication from authorization and treats the gap between them as one of the most overlooked risks in modern web applications. A user may log in correctly and still lack permission to access every resource, account, or action. Posts repeat a practical rule: every sensitive action should verify both who the user is and what they are allowed to access. The argument also appears in OWASP commentary, which singles out broken access control as the top threat and evidence that authorization logic remains the hardest part of application security.
- **Design security in rather than patching bugs after release**: Md. Jony Hassain reads changes to the OWASP list as a signal for teams to move from patching bugs to secure-by-design architecture, treating framework categories as priorities for developers rather than reference material for auditors. That broadens the scope beyond the web page: third-party dependencies and the build pipeline are part of application security because compromised code or an insecure deploy path can let an attacker ship malicious updates automatically. Recommended practices include securing CI/CD pipelines, verifying code integrity and dependencies, enforcing access controls and code signing, and monitoring builds and deployments.
- **Security is a business survival question, not an IT one**: Md. Jony Hassain writes directly to the people who approve security spending—founders, CEOs, and CTOs—and argues that breaches threaten business survival, not just technology. The case rests on three points: customer trust is the top asset, investors look for proof of security readiness, and business continuity depends on proactive defense. The same framing appears in a post aimed at developers, which sets feature pressure against security and argues that secure coding, threat modeling, and regular updates belong in every release.
- **Find weaknesses before attackers do, across six areas**: Md. Jony Hassain defines web ethical hacking as a controlled, authorized process for finding weaknesses before real attackers exploit them. The posts repeat a short sequence: test the web application, identify vulnerabilities, and fix weaknesses before they become incidents. Security should start before an attack, not after one. The test scope follows a recurring six-part checklist—authentication, access control, APIs and integrations, sensitive data, business logic, and configuration—with a plain question for each, such as whether accounts can be compromised. For businesses, one overlooked weakness can lead to data exposure, unauthorized access, downtime, financial loss, or lost customer trust. Testing helps businesses understand where they are exposed rather than assume the site will fail.

## Work to read

- [Uncovering a Critical Business Logic Flaw: Bypassing Validation via Negative Value Injection](https://www.linkedin.com/posts/md-jony-hassain_cybersecurity-penetrationtesting-bugbounty-activity-7434273589815721984-lhVZ)
- [The Evolution of Web Security: OWASP Top 10 (2025) is here!](https://www.linkedin.com/posts/md-jony-hassain_cybersecurity-owasp-websecurity-activity-7435720251473997824-w1q3)
- [Your website may look perfectly fine to customers.](https://www.linkedin.com/posts/md-jony-hassain_cybersecurity-websecurity-webpentesting-activity-7508222385788100608-Ebyj)
- [Founders, CEOs, and CTOs — do you know the biggest risk to your business today?](https://www.linkedin.com/posts/md-jony-hassain_cybersecurity-websecurity-startupsecurity-activity-7431929103852847104-jRq-)
- [Broken Access Control is one of the most overlooked risks in modern web applications.](https://www.linkedin.com/posts/md-jony-hassain_cybersecurity-websecurity-ethicalhacking-activity-7508549815484604417-9aXE)
- [OWASP Top 10 – #08 Software & Data Integrity Failures](https://www.linkedin.com/posts/md-jony-hassain_owasptop10-softwareintegrity-supplychainsecurity-activity-7425017986450649088-MVeS)

## Brand relationships

- **VulnBook** (mention)
- **HexaCyberLab** (mention)

## Partnerships

The material reviewed includes no sponsorship programme, media kit, rate card, disclosed brand partnership, or verified public partnership inquiry page. The account’s only stated commercial offer is a direct invitation to work together: a post addresses founders, CEOs, and CTOs, describes the creator’s focus on web security and penetration testing for SaaS, startup, and e-commerce platforms, and invites them to connect to build a tailored security roadmap. A second post describes a SaaS client that approached the creator over a suspected user data leak, using “us” for the testing work, but names no company, rate, or contract terms. Buyers should treat this as a privately arranged consulting or testing engagement, not a published package, and agree directly on scope, deliverables, timing, and confidentiality before work starts.

## Alternatives

- Huzaifah S.: Consider Huzaifah when the decisive question is how a tester reasons about authorization, rather than what a finished report looks like. Their IDOR post sets out a repeatable method for the same SaaS need: map every sensitive object type; treat UUIDs, Base64 and hashed identifiers as still requiring authorization checks; test secondary actions such as update, delete, export, share and permission changes; walk trust boundaries from user to user, user to admin and one organization to another; and inspect batch and mass-action endpoints where large-scale exposure can hide. For a multi-tenant product whose main risk is one customer reaching another customer's records, this is a more explicit testing plan than Hassain's posts offer. It names the endpoints and actions a buyer would want covered.
- Darius Radford: Consider Darius when the buyer's question extends beyond one web application to how the whole path from commit to production is governed. Their posts describe the Secure Software Factory, an operating model with pillars covering secure CI/CD delivery, security inside developer workflows, artifact and supply chain governance with SBOMs, risk correlation that joins code findings with infrastructure and runtime behaviour, and post-deployment protection with AI governance across the model. They also describe a structured assessment with a maturity index, a phased roadmap, owners and milestones, and a whitepaper behind a registration link. That suits a buyer seeking an organization-wide maturity baseline and sequenced improvement plan, or a supplier review covering dependencies and pipelines rather than a single application test.
- Ricardo Camacho: Consider Ricardo when the buyer's product is not purely web: firmware, a connected device, a vehicle or another embedded component is in scope, or the scope expands to a testing strategy across static analysis, dynamic analysis and fuzz testing, and penetration testing. Their posts cover automotive cybersecurity, ISO/SAE 21434, software-defined vehicles, verification activities such as static analysis and structural coverage, and AI-assisted verification with human oversight. They also include a guide to three complementary testing approaches and the shift-left practices around them. For a product team testing during development and again after deployment over a long lifecycle, that framing answers questions a pure web test does not.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/