mersa-v6

I'm Alaa, known as mersa-v6 — a cybersecurity researcher and bug bounty hunter focused on finding real-world security vulnerabilities in production web and mobile applications, APIs, modern AI systems, and SaaS platforms.

My research covers web and mobile application security, API and GraphQL security, payment and billing logic bypasses, IDORs, broken access control, authentication and authorization flaws, business logic vulnerabilities, vulnerability chaining, and responsible disclosure.

I work across public and private bug bounty programs, focusing on practical impact, clear reporting, and helping organizations secure real-world attack surfaces.