Live engagement — client.sa
IDOR · invoices API
7.1 · highChanging the invoice ID returns another tenant's invoice.
Penetration testing as a service · in Saudi Arabia
Test your platform like attackers would,
before they get there first.
Elite Saudi penetration testers — ranked among the top 10 on bugbounty.sa, the Saudi Federation's vulnerability discovery platform — test your web apps, APIs and mobile apps. Every finding documented with a CVSS score, every fix verified with a free retest. No critical or high findings? You don't pay.
Live engagement — client.sa
live · day 6 of 14
0
documented findings so far
- Critical3
- High4
- Medium5
- Low2
highest scoreCVSS 9.1
findings — live feed
- IDOR · /v2/invoicesdocumented ✓
- JWT · weak secretdocumented ✓
- SSRF · /uploaddocumenting…
- XSS · /searchclosed ↺
- SPF · mail recordlogged
Trusted by government bodies and national entities
01 · The platform
Every finding has
Every finding has
proof behind it.
Every result in a Reliant report is backed by real evidence: full reproduction steps, an official CVSS score, and complete manual review before delivery. Anyone on your team can verify it themselves — without having to ask you.
How we document every findingGET /v2/invoices/1042 → 200 GET /v2/invoices/1043 → 200 · tenant B
CVSS 7.1
highRetest · closure
fixed ✓Retested after the fix and closed for good.
- Findings with evidence
- Repro step by step
- Official CVSS scoring
- Closed after retest
02 · Coverage
Any system you need
Any system you need
tested? Covered.
Take one service or all of them. Each is scoped and priced independently, and one team stays accountable for the findings it delivers — from the first scan to the last closed finding.
Scope it with us- Web appsbusiness logic & sessions
- APIsREST & GraphQL
- MobileiOS & Android
- External assetsSubdomains & public IPs
- AuthJWT & OAuth
OWASP Top 10
OWASP API
PTES
NCA ECC
SAMA CSF
CVSS v4.0
03 · Founding team
Four founders.
Four founders.
Elite security leaders.
An all-Saudi team — elite pentesters with global achievements and proven real-world results, all ranked among the top on the national bugbounty.sa platform.
3900+combined documented findings
#1on bugbounty.sa — Q1 2026
Black Hatbest report 2025 · 1st MEA 2024 Jr
CVEcritical finding in an IBM partner product
OA
Penetration tester — #1 on Saudi Arabia's bugbounty.sa for Q1 2026 and #3 all-time. Discovered and documented 1,800+ vulnerabilities across real organizations and global companies. Specializes in API and web security.
RA
Offensive security pentester ranked in the all-time top 7 on bugbounty.sa, and Q4 2025 champion with 4,855 points. Awarded Best Report at Black Hat 2025 among 100 pentesters. Discovered 1,300+ vulnerabilities, specializing in deep manual testing and business-logic flaws across web and mobile applications.
GH
Ghaith Alotaibi
Penetration Tester
Web and API penetration tester — 1st place at Black Hat MEA 2024 (Bug Bounty Jr) and top 11 all-time nationally. Documented 500+ accepted vulnerabilities for government and private entities, and found 20+ critical flaws in a single misconfigured target. Certified eCPPTv3, eWPT and CWES.
FA
Pentester behind CVE-2026-26758 — a critical, globally documented flaw in an IBM partner product. Documented 300+ accepted vulnerabilities that helped secure 60+ government and private entities. Certified eWPT, specializing in authentication, authorization and business-logic bypasses.
04 · Our promise
No critical or high findings?
No critical or high findings?
You don't pay a riyal.
We carry all the risk. If we test your agreed scope and confirm no Critical or High vulnerability, the invoice is zero and the test and its report are yours, free — because our confidence in our researchers and methodology is your guarantee, and because security is bought with results, not promises.
- Pay only when a Critical or High finding is confirmed — no hidden flat fees
- Every result manually reviewed and reproduced before delivery
- Free retesting after every fix, until the finding truly closes
05 · Terms & conditions
Clear terms,
Read the full terms & conditions
Clear terms,
before we start.
The key points of working with Reliant, in short. The full text is on the Terms & Conditions page.
No critical or high findings? You pay nothing
If Reliant's triage team doesn't confirm a Critical or High vulnerability in your program, you pay nothing — and the test and its reports are still delivered, free.
You pay only after confirmation
Fees become due only once Reliant has verified a Critical or High finding, and the fee is the budget agreed for the program, not a charge per finding; its invoice is issued automatically with the report. Duplicate, invalid or out-of-scope reports are never billed.
A scope you approve
Researchers test only the assets you defined, under the rules of engagement you accepted — nothing outside them.
Full confidentiality
Findings and reports are your confidential information; researchers may not disclose or publish them without your written consent.
Free retests
Once you fix a confirmed finding, you can request a free retest while the program is in its report or retest stage — the result reaches you as soon as the check is done.
The reports are yours
Ownership of the reports passes to you once what is due is paid — or on delivery, when the test is free.
06 · FAQ
What clients ask
All frequently asked questions
What clients ask
before they call.
How is an engagement priced?
Three factors: the size of the scope (how many apps and APIs), the depth of testing you need, and the timeline. Together they set the program's agreed budget — one amount for the whole engagement, payable only if a Critical or High finding is confirmed, with no per-finding charges or hidden fees.
What if you don't find a critical or high vulnerability?
The invoice is zero. We carry the risk entirely — you pay only if we document a Critical or High vulnerability that is exploitable and verified by hand; otherwise the test and its report are free and delivered as usual.
How long does testing take?
It depends on scope, but most engagements are completed within 5 to 10 working days. From the first call you get a clear timeline: when testing starts, when the report lands, and when retesting begins.
Is testing safe on production?
Yes. Rules of engagement are signed before we start: defined time windows, testing boundaries, and instant escalation channels. We test like a real attacker without disrupting operations.
Share your requirements.
Fill in the form or book a 30-minute consultation with a lead penetration tester — we'll review your systems and reply with a clear scope and next steps.
- info@reliant.sa
- +966 54 966 9661
- Riyadh, Saudi Arabia