سلطان عبيد الشمري

Identified a Firebase misconfiguration where a public API endpoint exposed SDK credentials, enabling anonymous authentication and unauthorized access to backend database structures due to weak security rules.

Discovered a Hardcoded Credentials vulnerability in a public frontend JavaScript bundle, exposing privileged credentials that granted unauthorized access to a backend CRM API and sensitive data.

Discovered an exposed and unrestricted Google Maps API key in a public client-side JavaScript bundle, exposing the organization to billing abuse (Denial of Wallet) and quota hijacking.

Found a publicly accessible WordPress debug.log exposing full filesystem paths, internal directory structure, and theme/plugin details, increasing the overall attack surface.

Identified a Reflected HTML Injection in a URL parameter reflected without output encoding, allowing injection of arbitrary HTML tags (content spoofing / potential XSS vector).