RD / Training
One-to-one online training in secure code review and code-assisted web and API penetration testing, taught in English, or in Arabic for Arabic speakers. I teach every student personally and adapt the pace, exercises and depth to what you already know. The material comes from my own work: I have reported 150+ security vulnerabilities and wrote the patches for two Linux kernel CVEs.
Each course is a complete one-to-one programme for $1,490: about 15 hours of live sessions, labs, review of your exercises and a final assessment. Your first 20-minute assessment call is free, and we agree your plan and start date after it.
01Training
Each course has a full syllabus. Your plan starts from a short assessment of what you already know, so your time goes where you need it, at your pace.
Learn to read an unfamiliar codebase the way an attacker would: trace untrusted input to the line that breaks, prove the vulnerability is exploitable and write a fix developers accept. Taught one to one, online, at your pace.
Learn to run a web and API penetration test the way a professional engagement runs: scope it, test it with the source code open, prove the impact safely, report it and verify the fix. Taught one to one, online, at your pace.
Sponsor individual training for one or more developers or security engineers. Each person is taught one to one, online, with a plan built around their level and the languages and frameworks your team uses.
02Prices
Each course is a complete programme: about 10 live one-to-one sessions of 90 minutes, labs prepared for the course, review of your exercises between sessions, a final assessment and a certificate of completion. The first 20-minute assessment call is free.
$1,490per course
Read code like an attacker, prove what you find and get it fixed.
$1,490per course
Test web apps and APIs with the source open, from scope to retest.
$2,690for both courses
One plan from source code to the running application, $290 less than the two courses separately.
$1,890per engineer
The same one-to-one programme for each engineer your company sponsors.
$150per session
90 minutes one to one on a question you choose: a finding you are stuck on, a review of your own code or the next step in your learning.
Prices are in US dollars. Your plan, number of sessions and start date are agreed after the free assessment call.
03Why one-to-one
We start with a short assessment. I then set the order, pace and depth of the material for you, move quickly through what you already know and spend longer where you need it.
Modules are built around real code, including CVE write-ups I published, such as the fast-jwt fix that took three attempts, and the two Linux kernel CVEs I fixed. You trace each flaw in source, then confirm it on a running copy of the application on your machine.
I review your exercises and your final report myself and go through them with you in our sessions.
Sessions are taught in English for international students, and in Arabic for Arabic speakers who prefer it. Arabic sessions keep the English terms you will meet in tools, reports and job descriptions.
04Instructor
I am an application security engineer and an independent security researcher. I prepare the material, labs and exercises myself and supervise every student personally.
05Learning path
Secure code review: trust boundaries, data flow, authentication, authorization and business logic, from source to proof to fix.
Code-assisted web and API penetration testing: scoping, testing, reporting and retesting a realistic engagement.
Company-sponsored one-to-one training for one or more developers or security engineers, each with their own plan.
06Start today
These free write-ups use the same method the courses teach. Each one follows a vulnerability from its source to its fix.
fast-jwt has patched RSA to HS256 algorithm confusion three times. CVE-2026-107722 shows why the first two fixes closed an input instead of the rule.
CVE-2026-21589 is an unauthenticated file read in eight Atlassian Data Center products. Here is the ordering bug behind it, and how to check your own code.
A Linux ice driver fix illustrates a common review mistake: treating a parser’s optional result as a guaranteed object.
A technical review method for React2Shell and CVE-2026-23864: separate safe decoding, permission checks and bounded work, then verify the deployed build.
07Questions
Send a short message about your level and goals. I reply within three days to arrange a free 20-minute assessment call, and we agree your plan and start date after it.
Each course costs $1,490 for about 10 one-to-one sessions of 90 minutes, with labs, exercise review, a final assessment and a certificate. Both courses together cost $2,690, and a single 90-minute session costs $150.
We meet online for live sessions. Between sessions you work on labs and exercises I set for your level, and in the next session we go through your results. The pace follows your progress, not a fixed timetable.
If you can read code and know the common web vulnerability classes, start with secure code review. If you already test web applications and want a professional, code-assisted method, start with the penetration testing course. Both are intermediate; I suggest a starting point after a short assessment of your level.
English for international students. Arabic speakers can choose Arabic or English; Arabic sessions keep the English terms you will see in tools, reports and job listings.
No. All sessions, labs, exercises and feedback are online.
You receive a certificate of completion when you pass the final assessment. It is issued by me and is not an industry certification such as OSWE. What an employer can check is the work itself: your final report.
Yes. All practical work uses applications I prepared for the course and open-source projects at versions with published advisories, running on your own machine. You never test a system you do not own or have written permission to test.
If you need more sessions than planned, each extra session costs $150, and we agree it before it happens.
Yes. Mention it in your message, or see the page on training for companies.
08Contact
Send a short message: which course, Arabic or English, your current level and what you want to be able to do. I reply within three days to arrange your free assessment call.
