The API That Returned Every Customer’s Private AI Assistant
An authorization flaw in an AI product API that exposed every customer’s private assistant data.
Read the writeup →
Ehtesham Ul Haq
Founder and Principal Security Researcher, The Hidden Finds
eJPT Certified, INE
About The Hidden Finds
Built To Find What Others Miss
The Hidden Finds was created after seeing a recurring problem across modern SaaS platforms and APIs:
Organizations often receive security reports filled with scanner output, while the vulnerabilities that actually matter remain undiscovered.
The focus became simple: identify real attack paths, validate exploitability, and provide findings that engineers can act on.
Founder-LedManual TestingSaaS & API FocusReal Exploitability
The Practice
One Tester, Start to Finish
The Hidden Finds LLC is registered in Wyoming, USA, and works with clients remotely, worldwide. It is a solo practice: the person who scopes an engagement is the person who tests it and writes the report, so nothing learned while scoping is lost by the time the findings are written up.
Proof Of Work
Recent Security Research
Published write-ups from active bug bounty and responsible disclosure work. The same techniques are applied to every client engagement.
How a Simple Profile Update Led to Cross-Tenant Data Exposure
A profile-edit flow with no ownership check, letting one tenant reach another tenant’s data.
Read the writeup →How a GraphQL Invitation Flow Exposed Users at Scale
An overly permissive resolver leaking registered accounts, internal identifiers, and user metadata.
Read the writeup →From User Enumeration to PII Exposure
Two lower-severity API flaws chained together into a confirmed $2,000 bounty payout.
Read the writeup →Why THF
Why Companies Work With The Hidden Finds
Direct senior involvement and practical product understanding without layers of generic delivery.
Founder Involvement
Scope, testing decisions, validation, and reporting remain connected to senior review.
Manual-First Investigation
Automation supports coverage, while important behavior and exploitability are validated manually.
Product-Risk Understanding
Findings are interpreted through roles, tenant models, sensitive data, and business workflows.
Practical Engineering Value
Reports prioritize reproduction, impact, remediation clarity, and efficient retesting.
How I Think
Security Philosophy
Good security work should make product risk clearer, not bury teams beneath more output.
Real Exploitability
Findings should represent realistic attack paths rather than theoretical weaknesses.
Product Context
Security testing must understand how systems behave in practice.
Clear Communication
Reports should help engineering teams make decisions, not create confusion.
Practical Remediation
Every finding should include actionable guidance and retesting support.
Manual Testing
Why Manual Testing Finds What Scanners Cannot
All testing is manual. Scanners are used for coverage, not for findings. A scanner can flag an outdated library, but it cannot tell that a viewer role should not be able to export, or that a refund can be requested twice. That takes knowing who each user is and what the product is meant to allow.
Who It Is For
Who the Work Is For
SaaS and API teams whose product keeps customer data behind roles and tenants: a platform where one customer must never see another's records, an API that partners call directly, or a product adding AI features that can read data or call tools.
Approach
How an Engagement Is Approached
Testing starts by learning the product the way its users do: what each role is for, which data belongs to whom, and which actions involve money or trust. It then follows the paths where a mistake would matter most. Alongside the areas listed further down, that includes race conditions and AI and LLM application security.
An active bug bounty and responsible disclosure practice runs alongside client work. Ongoing retainers are available on request.
Boundaries
What I Will Not Do
Report scanner output
Nothing goes in a report until I have reproduced it by hand.
Inflate severity
Ratings reflect what an attacker could actually reach.
Test outside scope
Anything marked off limits during scoping stays untouched.
Promise a clean result
A test reports what it finds. It cannot prove that nothing else exists.
Company Story
The Hidden Finds Journey
A steady focus on practical application security, direct delivery, and findings that improve real products.
Established
Founded with a focus on practical application security testing.
Broader Product Coverage
Expanded across SaaS applications, APIs, authentication, and access control reviews.
Deeper Abuse-Case Work
Strengthened focus on IDOR, broken access control, business logic abuse, and API security.
Founder-Led Workflows
Built deeper review workflows for SaaS and product teams.
Clearer Consulting Delivery
Expanded structured services, positioning, and security consulting delivery.
Practical Product Security
Founder-led reviews focused on exploitability, product risk, and engineering-ready remediation.
Specialization
What I Focus On
Focused expertise for security-sensitive product behavior across modern SaaS and API systems.
API Security Testing
REST and GraphQL authorization, object access, token scope, and data exposure.
Access Control & IDOR
Role boundaries, ownership checks, tenant isolation, and privilege escalation.
Authentication Security
Login flows, sessions, recovery, token handling, and account takeover paths.
Business Logic Testing
Valid product actions that can be chained or manipulated into unintended outcomes.
Application Security Testing
Manual testing across critical features, sensitive data paths, and user flows.
Vulnerability Assessment
Validated weaknesses, exposed assets, prioritization, and remediation direction.
I am not hiring at the moment, but if you test applications seriously and want to be on my radar, the career page lists the areas I pay attention to.
Founder-Led Review
Security review that understands product risk
Practical guidance grounded in real attack paths, business impact and remediation support.
Direct Senior ReviewProduct-Risk ContextRetesting Support