Md. Jony Hassain

A site can be technically secure yet let users bypass controls, misuse workflows, or access actions they should not.

• Interface limits are not validation: a server can accept an input as a number without checking whether the resulting state makes sense.
• Md.
• Jony Hassain recommends strict server-side input validation and checking the integrity of an account's state before any update, rather than trusting what the front end allows.

In a walkthrough of a test against a platform called VulnBook, the Add Balance feature was meant to accept $1 to $500.

• Entering minus $1,000 was accepted, producing a negative balance.
• A later deposit of 100 was added to that negative state (minus 900 plus 100 equals minus 800), with no check that the starting state was already invalid.
• Checkout still completed purchases while the balance was negative, showing that the order logic never compared the balance with the price.

Read original · Original 2

Jony Hassain distinguishes authentication from authorization and treats the gap between them as one of the most overlooked risks in modern web applications.

• A user may log in correctly and still lack permission to access every resource, account, or action.
• Posts repeat a practical rule: every sensitive action should verify both who the user is and what they are allowed to access.
• The argument also appears in OWASP commentary, which singles out broken access control as the top threat and evidence that authorization logic remains the hardest part of application security.

A post lists what a small authorization flaw can expose: private user data, admin functionality, sensitive business information, and other users' accounts.

• A companion post turns the same point into plain questions a business should be able to answer: Can accounts be compromised?
• Can users access information they should not?

Read original · Original 2 · Original 3

Jony Hassain reads changes to the OWASP list as a signal for teams to move from patching bugs to secure-by-design architecture, treating framework categories as priorities for developers rather than reference material for auditors.

• That broadens the scope beyond the web page: third-party dependencies and the build pipeline are part of application security because compromised code or an insecure deploy path can let an attacker ship malicious updates automatically.
• Recommended practices include securing CI/CD pipelines, verifying code integrity and dependencies, enforcing access controls and code signing, and monitoring builds and deployments.

One post compares the 2021 and 2025 OWASP Top 10 and highlights four shifts: broken access control staying at number one, software supply chain failures entering at A03, security misconfiguration climbing to A02, and mishandling of exceptional conditions entering at A10, with the supply chain move flagged as the surprise. A separate post on OWASP #08, software and data integrity failures, names supply chain attacks and unauthorized code execution as risks and lists the CI/CD and code-signing practices above.

Read original · Original 2 · Original 3

Jony Hassain writes directly to the people who approve security spending—founders, CEOs, and CTOs—and argues that breaches threaten business survival, not just technology.

• The case rests on three points: customer trust is the top asset, investors look for proof of security readiness, and business continuity depends on proactive defense.
• The same framing appears in a post aimed at developers, which sets feature pressure against security and argues that secure coding, threat modeling, and regular updates belong in every release.

One post describes a SaaS company facing a possible user data leak.

• Penetration testing surfaced critical vulnerabilities and secured the platform; the post ties that work to gained investor trust and a closed funding round.
• A second post cites an e-commerce site that launched features without proper security testing and faced a $2.5 million data breach, customer trust loss, and legal penalties.
• To assess these examples, ask for the scope, method, and timeline; neither client is named, and none is provided.

Read original · Original 2 · Original 3

Jony Hassain defines web ethical hacking as a controlled, authorized process for finding weaknesses before real attackers exploit them.

• The posts repeat a short sequence: test the web application, identify vulnerabilities, and fix weaknesses before they become incidents.
• Security should start before an attack, not after one.
• The test scope follows a recurring six-part checklist—authentication, access control, APIs and integrations, sensitive data, business logic, and configuration—with a plain question for each, such as whether accounts can be compromised.
• For businesses, one overlooked weakness can lead to data exposure, unauthorized access, downtime, financial loss, or lost customer trust.
• Testing helps businesses understand where they are exposed rather than assume the site will fail.

An assessment-scope post works through six areas, posing a question for each, and argues that a website that looks fine to customers is not necessarily a secure business. A companion post makes the case for ethical hacking as a regular, authorized exercise to understand risk, fix weaknesses, and build a stronger security foundation.

Read original · Original 2 · Original 3 · Original 4

A full walkthrough of a test against a platform named VulnBook.

• The Add Balance feature was meant to accept $1 to $500; entering minus $1,000 was accepted and produced a negative balance.
• A later deposit of 100 was added arithmetically to the negative state (minus 900 plus 100 equals minus 800), with no check that the starting state was already invalid.
• Checkout still completed purchases while the balance was negative, showing the order logic never compared balance to price.
• The post closes with two fixes: strict server-side validation of inputs, and verifying the integrity of account state before any balance update.
• It names the failure mode at each step rather than stopping at a headline.
• The target is a practice platform, not a client.

For brands planning a campaign

Put this sample in front of a buyer asking what an assessment deliverable looks like. Ask whether a live engagement would include the same mechanism-level detail and reproduction steps, and whether business logic is explicitly in scope.

Compares the 2021 and 2025 OWASP Top 10 and picks out four shifts: broken access control staying at number one, software supply chain failures entering at A03, security misconfiguration climbing to A02, and mishandling of exceptional conditions entering at A10.

• The post argues that teams should move from patching bugs to secure-by-design architecture, then asks readers which ranking surprised them.
• It is framework commentary designed to start a discussion, not a client-facing report.

For brands planning a campaign

If your brief or security team expects OWASP-aligned findings, this is the reference frame. Expect categorised findings tied to a published list; ask for the mapping explicitly rather than assuming it.

Lists six areas a proper assessment examines — authentication, access control, APIs and integrations, sensitive data, business logic, and configuration — each with a plain question attached, such as whether accounts can be compromised or users can reach information they should not.

• The post argues that a working website is not automatically a secure business; one overlooked weakness can lead to data exposure, unauthorised access, downtime, financial loss, or lost trust.
• Testing, it says, is about knowing where the business is exposed rather than expecting it to fail.

For brands planning a campaign

Use this as the shared agenda at kickoff. It maps onto six areas a SaaS buyer would want covered, so a brief can adopt the same headings and ask for a finding and a fix under each one.

Addresses founders, CEOs, and CTOs directly and states a focus on web cybersecurity and penetration testing for SaaS, startup, and e-commerce platforms.

• It describes a SaaS company that approached Hassain about a possible user data leak, says penetration testing surfaced critical vulnerabilities and the platform was secured, and claims the outcome was investor trust and a closed funding round.
• The supporting argument has three points: customer trust is the top asset, investors look for proof of security readiness, and continuity depends on proactive defence.
• The post ends by offering to build a tailored security roadmap.

For brands planning a campaign

The funding-round framing is an easy angle for a founder to reuse in an internal argument for budget. The case study is anonymous and unspecific, so ask for its scope, method, and timing before treating it as proof of results in a comparable environment.

A user may be properly authenticated and still should not reach every resource, account, or action.

• The post says a small authorisation flaw can expose private user data, admin functionality, sensitive business information, and other users' accounts.
• Every sensitive action, it concludes, should verify both who the user is and what that user is allowed to access.
• The explanation is short, concrete, and consistent with the access-control emphasis in the OWASP post.

For brands planning a campaign

Useful language for a brief that includes authorisation testing, and a quick test of how clearly Hassain explains a finding to a non-specialist. Ask for the same distinction in a sample report section.

Integrity failures happen when applications rely on untrusted code, insecure updates, or weakly protected CI/CD pipelines, allowing an attacker to push code that deploys automatically.

• The risks named are supply chain attacks, unauthorised code execution, and compromise of systems and data.
• Recommended practices include securing CI/CD pipelines, verifying code integrity and dependencies, enforcing access controls and code signing, and monitoring builds and deployment.
• This is one of several posts that follow the OWASP categories one by one.

For brands planning a campaign

If your product ships through third-party dependencies or an automated pipeline, this is a scope item Hassain already describes in operational terms. Raise it during scoping to establish whether the assessment would extend to the build process and under what constraints.

Jony Hassain argues that web security is not just a technical or IT concern but a business survival issue.

• Across posts, they scope a proper web security assessment around six areas: authentication, access control, APIs and integrations, sensitive data, business logic, and security configuration.
• Their core warning: a website can look fine and still let users bypass controls, misuse workflows, or reach actions they should not.
• The language targets decision-makers: secure the technology, protect the business logic, preserve trust.

Repeats a six-area assessment checklist: authentication, access control, APIs and integrations, sensitive data, business logic, and configuration.

The posts name no testing tools, standards beyond OWASP, or compliance frameworks. Ask which tools and frameworks would guide the assessment.

For brands planning a campaign

A B2B SaaS buyer can use this to judge whether the creator explains risk in business terms and scopes testing beyond a basic vulnerability scan. Ask for an assessment plan covering all six areas, not just common vulnerability classes.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

The front end showed a $1 to $500 range, but the server did not validate the logical integrity of the input.

• The result was a negative account balance, and subsequent deposits were simply added to the negative state.
• Checkout still worked with the negative balance, showing the order logic did not verify that balance was greater than or equal to price.
• The post lays out discovery, proof of concept, business impact, and remediation.

Uses a case-study format: discovery, attack vector, proof of concept, business impact, and remediation strategy.

The named platform appears to be a practice or test target, not a confirmed paying client engagement. Ask whether the work was conducted for a client.

For brands planning a campaign

For a SaaS company concerned about business logic abuse, Md.

• Jony Hassain's posts explain a flaw from discovery through fix.
• This can support a campaign asking for server-side validation review, state-integrity checks, and checkout or payment testing.

Examples: Source 1

Jony Hassain covers OWASP framework changes for developers and security professionals.

• One post compares the 2021 and 2025 lists, highlighting Broken Access Control as the top threat, Software Supply Chain Failures entering at A03, Security Misconfiguration moving to A02, and Mishandling of Exceptional Conditions at A10.
• Another explains OWASP #08, Software and Data Integrity Failures, focusing on compromised CI/CD pipelines and malicious updates.
• The recurring argument: teams should move from patching bugs to secure-by-design architecture.

Uses side-by-side 2021-versus-2025 comparisons, numbered OWASP items, and short risk-area explainers.

The posts do not provide a full OWASP Testing Guide methodology. Ask for the testing protocol if the campaign requires one.

For brands planning a campaign

A buyer can assess whether the creator is current with OWASP and can translate framework shifts into practical priorities for a SaaS engineering team. This fits a security awareness or secure-development campaign.

Examples: Source 1 · Source 2 · Source 3

It says a small authorization flaw can expose private user data, admin functionality, sensitive business information, and other users' accounts. The practical point: every sensitive action should verify who the user is and what they are allowed to access.

Frames the issue with concrete exposure categories and a short rule: authentication alone is not enough.

The post does not describe specific access-control test cases, such as horizontal or vertical privilege escalation. Ask whether the assessment will cover those scenarios.

For brands planning a campaign

This is relevant for SaaS clients with user roles, admin panels, or multi-tenant data. A campaign brief can ask the creator to test authorization per object and per action, not just login security.

Examples: Source 1 · Source 2 · Source 3

Jony Hassain describes web ethical hacking as a controlled, authorized process of finding weaknesses before real attackers exploit them.

• Across posts, the message is consistent: test the web application, identify vulnerabilities, and fix weaknesses before they become incidents.
• Security should start before an attack, not after one.
• The posts connect testing to authentication, access control, APIs, sensitive data, business logic, and web application security.

Uses short directive language and a three-step framing: test, identify, fix.

The available posts show no specific certifications, CVE credits, or bug bounty disclosures to establish hands-on track record. Ask for relevant credentials or examples of past work.

For brands planning a campaign

A B2B SaaS buyer can use this to check whether the creator explains authorization boundaries, testing scope, and remediation in plain language. It supports a brief for a proactive web application assessment rather than an incident response engagement.

Examples: Source 1 · Source 2 · Source 3

It cites an e-commerce site that launched without proper security testing and faced a $2.5 million data breach, then lists secure coding, threat modeling, and regular updates as required practices. Another post addresses founders, CEOs, and CTOs, describing a SaaS penetration test that found critical vulnerabilities and helped the company keep investor trust and close a funding round.

Pairs an infographic scenario with a business-cost example and a direct address to decision-makers.

The $2.5 million breach and SaaS funding-round case are presented without named clients or source links; treat them as illustrative, not verified case histories.

For brands planning a campaign

This shows the creator can speak to developers and business leaders. A campaign could draw on their expertise for secure-coding content, founder-level security education, or a security roadmap discussion tied to customer trust and investor readiness.

Examples: Source 1 · Source 2

Jony Hassain repeatedly names SaaS, startup, and e-commerce platforms as businesses they focus on protecting.

• The posts connect web security and penetration testing to customer trust, investor confidence, business continuity, and financial integrity.
• One offers to help founders, CEOs, and CTOs create a tailored security roadmap; another ties a business logic flaw directly to revenue loss and unreliable reporting for e-commerce.

Uses direct-address posts, case-study framing, and business-outcome language rather than purely technical descriptions.

The available posts do not establish employer, client list, team size, or commercial terms. Ask for these details before contracting.

For brands planning a campaign

This is a direct signal for a B2B SaaS security brief. Buyers can assess whether the creator understands their context and can speak to both technical teams and executives.

Examples: Source 1 · Source 2 · Source 3 · Source 4

Jony Hassain's posts are short-form LinkedIn content built around checklists, numbered OWASP explainers, case studies, risk lists, and direct questions to readers.

• They commonly use arrows, bullet points, and hashtags to organize a single idea, and sometimes end with a call to connect or discuss in the comments.
• The approach is educational and repetitive by design: the same six-area assessment framework and secure-by-design message recur across multiple posts.

Short posts use bullet lists, arrows, hashtags, and occasional audience questions or connection prompts.

If a campaign requires newsletters, long-form articles, talks, or video, ask for samples; none appear in Md. Jony Hassain's posts here.

For brands planning a campaign

The recurring framework suits campaigns built around a series of readable security lessons, such as assessment areas, OWASP changes, or business logic vulnerabilities. Buyers should consider whether they also need longer-form assets.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5 · Source 6 · Source 7 · Source 8 · Source 9 · Source 10

Jony Hassain describes security testing on a platform called VulnBook, entering a negative balance to bypass the stated $1–$500 range and showing that checkout still completed with a negative balance. The post presents VulnBook as a test target in an instructional example; ask whether any commercial, client or employment relationship exists.

View example

The posts do not explain what HexaCyberLab is or how Md.

• Jony Hassain is connected to it.
• Ask whether the connection involves a partnership, sponsorship or employment.

View example

Huzaifah S. sets out a structured IDOR method: map every sensitive object type; test update, delete, export, and permission changes, not just read access; then check privilege boundaries between users, admins, and organisations.

• This is the testing counterpart to Md.
• Jony Hassain's repeated argument that authentication alone is not enough and every sensitive action needs its own permission check.

Huzaifah S. writes as a method-first practitioner, offering a step-by-step testing playbook and a post on free tools for people starting out, with no business framing.

• Md.
• Jony Hassain addresses decision-makers, framing the same subject as a six-area business assessment and linking it to outcomes such as revenue loss, data exposure, and investor confidence.
• Readers who want to run authorization tests should read Huzaifah S.; those judging how a tester explains risk to a business should read Hassain.

Read original · Original 2 · Original 3 · Original 4 · Original 5

Darius Radford frames the problem as tool adoption without integration, governance, or operating discipline.

• Md.
• Jony Hassain makes the same case when reading the OWASP changes: stop patching bugs and design security in.

Darius Radford works at the programme and pipeline level, covering the Secure Software Factory pillars, a maturity baseline, a phased roadmap, and named capabilities such as SBOMs, artifact governance, and unified risk correlation.

• Md.
• Jony Hassain focuses on live web applications and individual flaws, testing a login, an order flow, or an API.
• Read Darius Radford for how to structure an engineering organisation; read Hassain for what an assessment of one web application covers.

Read original · Original 2 · Original 3 · Original 4

Ricardo Camacho lays out static analysis, dynamic analysis and fuzzing, and penetration testing as complementary approaches, stressing shift-left, secure coding, and security gates in CI/CD.

• Md.
• Jony Hassain takes the same before-the-incident position on web testing.

Ricardo Camacho covers embedded and automotive software: software-defined vehicles, hundreds of ECUs, over-the-air updates, ISO/SAE 21434, and the difficulty of patching deployed devices.

• Md.
• Jony Hassain covers web applications and the business workflows behind them.
• The comparison shows how the build-it-in argument changes when the target is hardware constrained rather than a server that can be redeployed.

Read original · Original 2 · Original 3 · Original 4

Their IDOR post sets out a repeatable method for the same SaaS need: map every sensitive object type; treat UUIDs, Base64 and hashed identifiers as still requiring authorization checks; test secondary actions such as update, delete, export, share and permission changes; walk trust boundaries from user to user, user to admin and one organization to another; and inspect batch and mass-action endpoints where large-scale exposure can hide.

• For a multi-tenant product whose main risk is one customer reaching another customer's records, this is a more explicit testing plan than Hassain's posts offer.
• It names the endpoints and actions a buyer would want covered.

The two posts include a career-motivation piece listing free tools, which says nothing about paid assessment work.

• Neither shows client engagement, a finding write-up, reproduction steps, remediation or a sample report; neither makes a commercial offer.
• Hassain's VulnBook post covers a complete finding, from discovery through mechanism and business impact to two fixes; Huzaifah's posts show method but not a delivered result.
• Keep Hassain in consideration when the buyer needs to see finished reporting before contracting; choose Huzaifah when buying testing depth on access control and assessing method directly.

Examples: Source 1 · Source 2

Their posts describe the Secure Software Factory, an operating model with pillars covering secure CI/CD delivery, security inside developer workflows, artifact and supply chain governance with SBOMs, risk correlation that joins code findings with infrastructure and runtime behaviour, and post-deployment protection with AI governance across the model.

• They also describe a structured assessment with a maturity index, a phased roadmap, owners and milestones, and a whitepaper behind a registration link.
• That suits a buyer seeking an organization-wide maturity baseline and sequenced improvement plan, or a supplier review covering dependencies and pipelines rather than a single application test.

The two posts present a framework and programme for promoting an assessment, not case work.

• Neither includes a specific vulnerability, reproduction steps or client outcome, or demonstrates a web application or business-logic test of the kind needed for the focused pre-launch assessment of billing, balances and permissions.
• The framework framing is heavier than that assessment requires and gives the buyer less to judge about hands-on technical depth.
• Hassain's negative-balance write-up shows a concrete finding the buyer can inspect before hiring; Darius's material shows a method for organising security work.

Examples: Source 1 · Source 2

Their posts cover automotive cybersecurity, ISO/SAE 21434, software-defined vehicles, verification activities such as static analysis and structural coverage, and AI-assisted verification with human oversight.

• They also include a guide to three complementary testing approaches and the shift-left practices around them.
• For a product team testing during development and again after deployment over a long lifecycle, that framing answers questions a pure web test does not.

Their evidence is embedded and automotive.

• The posts say nothing about SaaS billing logic, tenant isolation or web application authorization.
• Hiring on this material for the stated web assessment means assuming that general testing discipline transfers to a different domain, with no web-specific example shown.
• If the product has no embedded or device surface, this work is adjacent rather than directly comparable; Hassain's web-focused posts are closer to the web assessment.

Examples: Source 1 · Source 2