Asim Alharbi.
I find the bugs your scanners miss, then build the systems that patch them automatically.
Offensive security engineer and bug bounty hunter based in Madinah, Saudi Arabia. Currently lead on Manee — a multi-agent AI cyber defense system for national infrastructure — and ranked #34 quarterly / #133 all-time on bugbounty.sa.
منيع — Manee.
A self-healing cyber shield for national infrastructure. Detects, blocks, explains, and auto-patches threats in < 12s.
An intelligent, self-healing cyber shield for critical national infrastructure — built as four cooperating AI agents that share signals in real time.
Most defenses detect. Manee detects, blocks at the kernel, explains the call, and ships a patch — without waiting for a human.
I break web apps the way attackers do — then write the report that helps your team patch it before they do.
I'm Asim Alharbi — online as 0x4s3m. Two-plus years deep in offensive security, with a focus on web-application pentesting and AI-assisted defense. I started in CTFs, learned to translate those primitives into real-world impact on production targets, and now build the systems on the other side of the table.
On bugbounty.sa I've filed 100+ reports across 64+ valid bugs — currently #34 quarterly / #133 all-time. I hunt where the noise is highest: complex auth flows, broken access control, recon dust, and the seams between APIs.
Recent findings, ordered by impact — not by date.
Most reports are under NDA. Below is a representative slice of categories and programs where I've delivered impact. Details linked where the program permits public disclosure.
-
2025 · Q3xxxxxxxxx.xxnational platform · multi-programcritical Auth bypass · ATO
Multi-step authentication flow abuse
Chained a session-state desync with a recovery-token race to take over arbitrary accounts pre-auth. Triaged, accepted, patched.
-
2025 · Q2xxxx.xxhealthcare · patient portalhigh IDOR · BOLA
Cross-tenant patient record access
Object-reference predictability allowed authenticated users to query records outside their tenant. Reported through the Saudi national bug-bounty platform.
-
2025 · Q2xxxxxx — xxxx.xxxxxx.xxxaviation · ITSD portalhigh Broken access control
Privilege boundary leak in support workflow
Help-desk endpoints exposed admin-only operations to standard users via parameter tampering. Accepted under their bounty program.
-
2025 · Q1xxxxxxx xxxxx xxxxxxxprivate program · NDAcritical SSRF
Blind SSRF → cloud-metadata exfiltration
PDF render service accepted user-controlled URLs without egress filtering; chained to internal-only services. Coordinated disclosure.
-
2024 · Q4E-commerce programretail · checkout flowmedium Race condition
Coupon stacking via single-packet attack
Sub-millisecond parallel requests bypassed one-per-customer voucher logic. Reported with PoC + Burp Repeater group.
-
ongoingOther targetsmultiple Saudi programsdisclosed Mixed
60+ additional findings
Stored/reflected XSS, mass assignment, JWT algorithm confusion, OAuth redirect abuse, business-logic flaws — across the xxxxxxxxx.xx platform.
writeups on x →
A practical loadout — refined on real programs.
Mapping attack surface across subdomains, ASNs, JS endpoints, and forgotten staging.
XSS, SSRF, SSTI, file upload, deserialization, prototype pollution, race conditions.
REST/GraphQL abuse, mass assignment, OWASP API Top-10, undocumented endpoint hunting.
IDOR/BOLA, JWT misuse, OAuth flow abuse, MFA bypass, session fixation, role escalation.
Wordlist craft, parameter mining, brute-forcing hidden paths, technique stacking.
Clear PoCs, repro-first writing, severity scoring (CVSS), remediation that ships.