I design and build production-grade digital products where sharp engineering and application security work as one discipline.
Built across the full delivery surface
Security pipeline
release/production
100%
checks passed
01 /// PROFILE
Mohamad Chalhoub is a Beirut-based software engineer and security specialist, building full-stack products since 2017.
2017
Building products since
04
Shipped case studies
02
Engineering disciplines
03
Working languages
02 /// CAPABILITIES
Two disciplines, applied together rather than handed off between specialists.
SVC // engineering
Full-stack applications that stay maintainable as they grow, from the database up to the interface.
SVC // security
Applications assessed and built the way an attacker would look at them, before they ship — not after.
03 /// STACK
Grouped by domain, not stacked as a wall of logos.
04 /// SELECTED_WORK
Selected client projects, plus anonymized security findings presented without exposing private platforms.
I include bug classes and remediation thinking only at a high level. Platform names, private reports, proofs of concept and client-sensitive details stay confidential.
Access-control and object-level permission issues
Login, token and session lifecycle weaknesses
Validation issues that can expose unsafe behavior
Headers, policy and deployment hardening gaps
Selected client delivery
Photography portfolio with a bilingual content workflow
A Next.js site backed by Supabase, with an admin dashboard for managing galleries and content directly, and multi-language support built into the routing and data model rather than bolted on.
Steel design & engineering company website
A responsive Next.js and Supabase site presenting the firm's services and engineering focus with a clean, content-led layout built for clarity over decoration.
Children's fashion e-commerce platform
A full-stack e-commerce platform built with Next.js, TypeScript and Supabase, pairing a customer-facing storefront with an administration dashboard for day-to-day operations.
05 /// APPLICATION_SECURITY
Alongside client work, I conduct independent security research and participate in bug-bounty programs on public disclosure platforms, following responsible-disclosure practices: findings go to the affected organization first, on their terms, before anything is made public.
Specific findings and the organizations involved stay confidential, in line with responsible disclosure. What's demonstrable is the methodology: systematic reconnaissance, structured testing against authentication, authorization and input handling, and remediation guidance written for the team that has to act on it.
Assessment coverage
Application surface · structured methodology
Method
06 /// DELIVERY_PROTOCOL
Engineering, design and security are handled together at every stage, not treated as separate hand-offs.
Start with the problem, not the tech. Clarify what the product needs to do, who it serves, and what 'done' actually looks like.
Design the data model, the API surface, and the trust boundaries together — authentication and authorization are decided at this stage, not bolted on later.
Implement in typed, componentized code with content and presentation kept apart, so the product stays easy to extend after launch.
Verify behavior across devices and edge cases, not just the happy path — including how the interface degrades without JavaScript or WebGL.
Review the same application from an attacker's perspective: input handling, session management, access control, and the server-side validation that backs every client-side check.
Ship something that performs, reads clearly, and holds up — with the reasoning behind each decision documented, not just the code.
07 /// SECURE_CHANNEL
Tell me what you’re building. I’ll reply personally to discuss scope, timeline and fit.