Fayad K. Hassan
Security research and open source intelligence
Two practices I run independently of the operations work: finding and disclosing software vulnerabilities through vendor programmes, and open source intelligence analysis alongside investigative journalists.
Credited by the vendors themselves
Each vendor’s own programme triaged the finding and acknowledged it publicly. Where the credit is public, the channel links to it, so every line is checkable at the source. The drawing above is generated from these rows.
| Vendor | Channel | Outcome |
|---|---|---|
| Vulnerability Reward Program | Hall of Fame | |
| Nokia | Coordinated Vulnerability Disclosure | Hall of Fame |
| Tesla | Bugcrowd | Hall of Fame |
| SpaceX | Bugcrowd | Hall of Fame |
| Keeper Security | Bugcrowd | Hall of Fame |
| Mattermost | Bugcrowd | Hall of Fame |
| Privy | HackerOne | Resolved, paid |
| UK Health and Safety Executive | HackerOne | Credited |
Vulnerability research
I look for web application vulnerabilities in production systems and report them through the vendor’s own disclosure programme. Everything here was submitted that way, triaged by the vendor’s security team, and acknowledged publicly by them. Nothing was published before a fix shipped.
Google credited a high-severity (P2) finding in its Vulnerability Reward Program Hall of Fame. Nokia lists me in its Coordinated Vulnerability Disclosure Hall of Fame, Bugcrowd carries hall of fame listings for Tesla, SpaceX, Keeper Security and Mattermost, and on HackerOne, Privy resolved and paid a report while the UK Health and Safety Executive credited one.
I do not publish technical detail that the vendor has not already published themselves. If you are evaluating the work and need more than a hall of fame entry, ask me directly and I will tell you what I can.
When you build the collection yourself, you know exactly what it missed.
Open source intelligence
I work on and off with investigative journalists, doing analysis from openly available material: satellite imagery, corporate and shipping records, procurement trails, and the social output of the people involved. The bulk of it has been on the war in Sudan, and it has contributed to reporting published by ZEIT Online.
The tooling is my own: open source collection libraries plus custom Python for correlation and timeline building, rather than an enterprise intelligence platform. That is a deliberate choice.
Sourcing and methods for live work stay private. Where findings have been published, the outlet carries them.
Where the analysis ends up
Published pieces on open source intelligence and the conflict. All writing.
An OSINT Tool Should Show Its Working
Storytime 2.1 is a free, self-hosted OSINT platform. It reads public sources only, runs a local agent that has to cite every claim it makes, and seals what it collects so the evidence can be checked later.
OSINT9 min
9 Aug 2025
A $10K OSINT Red-Team Against a Simulated Intelligence Network
A tabletop red-team against a fictional joint-intelligence network, run on open-source material and a small budget.
OSINT8 min
25 Jul 2025
The High Price of Ambition: UAE’s Role in Sudan’s Costliest Conflict
From strategic advantage to international blowback: how the RSF proxy gamble may have backfired, and what it cost the state that placed the bet.
Geopolitics8 min
29 Sep 2023
Sudan’s Proxy War Unveiled: How Regional Powers Are Crafting a New Form of Conflict
How outside powers turned Sudan’s civil war into a proxy contest, and what that newer, deniable form of intervention looks like on the ground.
Geopolitics15 min
Tell me what isn’t adding up
An operation that has outgrown its spreadsheets and phone calls, a system that says one thing while the business does another, or a security or OSINT question. I read every message myself.
Or write directly to fayad_k@outlook.com