Salah Chafai

About

❯neofetch

────────────────

OS

Salah Chafai (arch, btw)

Role

Security Researcher / Exploit Developer

Focus

PwnReverse EngineeringLow-Level

Stack

CPythonx86-64 ASMRustShaders

Shell

zsh

────────────────

I do stuff.

Visitors

CTF Achievements

Experience

1. 

   Securinets

   September 2024 – Present · 2 roles
   1. Technical Lead July 2026 - Present
      • Own technical direction for the competition platform: infrastructure architecture, deployment pipeline, and release standards.
      • Lead post-event reviews that turn incident findings into reliability and hardening fixes in the platform.
      • Onboard and mentor new members on the team's infrastructure, tooling, and challenge workflow.
   2. Technical Instructor September 2024 - June 2026
      • Designed and operated containerized challenge infrastructure sustaining 100% uptime for 400+ participants per event.
      • Delivered hands-on secure-coding and binary exploitation workshops to students from 10+ universities.
      • Authored exploitation and reverse engineering challenges modeling real-world memory-safety and logic flaws.
2. 

   EY

   1. Security Engineering Intern June 2026 - August 2026
      • Designed and threat-modeled Bastion, a hardened bootable Linux platform delivering encrypted competition content while blocking AI-assisted cheating: hardened kernel build (lockdown LSM, IOMMU, loadable modules disabled), runtime policy through LSM hooks (execution allowlisting, egress whitelisting, ptrace scoping), and TPM 2.0 boot attestation; documented residual attack surfaces (DMA, cold-boot, hypervisor) and their accepted risk.
      • Built the encrypted delivery and key-release path end to end: AES-256-GCM with per-user HKDF-SHA256 derivation, HashiCorp Vault/HSM key storage, and mutual TLS 1.3 with certificate pinning and nonce/timestamp replay protection, so no key material ships in the image and one compromised session key cannot decrypt another user's content.
      • Penetration-tested an Android application and its backend, reporting missing admin-console MFA, an unthrottled submission endpoint enabling email-flood denial of service and sender-reputation abuse, and missing FLAG_SECURE exposing PII through screenshots and recents thumbnails.
3. 

   Cargo One Express

   1. Web Security Engineer October 2025 - December 2025
      • Delivered a secure recruitment platform end to end, adding OAuth 2.0 authentication and encrypted at-rest storage so applicant documents and PII were never persisted in cleartext.
      • Designed least-privilege role-based access control across employer dashboards for review, task allocation, and time tracking.
      • Hardened the REST API with server-side authorization on every endpoint, closing cross-account access to applicant records.
4. 

   FL1TZ

   1. CTF Player September 2024 - Present
      • Consistently achieved top rankings in competitive CTFs at both national and international levels.
      • Qualified for prestigious competitions including Arab Security Cyber Wargames, Blackhat, Cybersecurity Tech Olymics & CSAW
      • Specialized in Pwn and Reverse Engineering categories across multiple CTF formats
5. 

   INSAT

   1. ICT Engineering Student 2023 - June 2028
      • Pursuing a National Engineering Diploma (Diplôme National d'Ingénieur): five-year integrated program, equivalent to a Master's degree
      • Relevant coursework: Ethical Hacking & Cybersecurity, Operating Systems & Virtualization, High-Speed Networks
6. 

   Phantom Penguin

   1. Lead Game Developer November 2020 - 2022
      • Led a cross-functional team of 6 developers to deliver 5+ desktop and mobile game titles from concept to release.
      • Coordinated task allocation and conducted structured code reviews, increasing team productivity by ~40%
      • Stabilized release builds through systematic testing and pre-release triage, achieving 100% on-time deliveries