Mohammad Favas S

APPLICATION SECURITY | PENETRATION TESTING (VAPT) | VULNERABILITY REMEDIATION | SECURITY AUTOMATION

Talent

ThiruvananthapuramMember since August 3, 2026

OWASP Top 10Secure Code ReviewInput SanitizationSQLiteDockerPython

Hire this person

Send a job offer directly to this candidate

OWASP Top 10Secure Code ReviewInput SanitizationSQLiteDocker

About

Information Security researcher specializing in Web application security, source-code analysis, and custom defensive tooling. Differentiates through a verified record of code-level remediation within the open-source ecosystem, including authoring a merged upstream patch for a structural improper access control flaw in a major Python framework. Experienced in automated scripting, API assessment, and reproducing complex exploit chains in financial technology platforms.

Partners with developers to identify root causes and eliminate software flaws from day one.

Experience

Software Developer - Security-Focused at Freelance (2024-04 – 2025-09)

Performed targeted secure code reviews across web applications, identifying and mitigating common OWASP Top 10 vulnerabilities including input validation gaps, cross-site scripting (XSS), and broken access controls.
Partnered directly with development teams to refactor source code pre-deployment, implementing input sanitization, secure session handling controls, and strict API authorization boundaries to reduce attack surfaces.
Documented technical findings, created reproducible step-by-step PoCs for engineering teams, and validated bug fixes and patch stability across application layers.
Engineered a lightweight, concurrent command-line security utility in Go to automate local reconnaissance, client-side endpoint harvesting, and asset identification.
Implemented high-performance regular expression pattern matching to extract sensitive exposure strings, API keys, and hidden routes from localized JavaScript source files.
Architected an automated data ingestion pipeline in Python to parse and normalize 55,000+ threat data records per execution from disparate open-source feeds into a unified schema.
Optimized script parsing and validation query latency by 40% through concurrent execution patterns and asynchronous thread pooling.
Programmed structured rule logic and automated database updates via a 6-hour systemd timer architecture to eliminate runtime drift and maintain data integrity.