Mutasem Kharma معتصم خرما.
Offensive Security Engineer & Full-Stack Developer. I engineer AI-powered security frameworks that hunt vulnerabilities autonomously — and ship production web applications at scale.
Who Am I
I'm a security engineer obsessed with building tools that think. My work lives at the intersection of offensive security, AI, and software engineering — creating autonomous systems that don't just find vulnerabilities, but weaponize and report them.
On the offensive side, I've built Aura — a fully autonomous DAST engine powered by Google Vertex AI — and Nexus-CTF, an AI-driven CTF exploitation framework. On defense, Kharma Sentinel provides real-time network intelligence with automated threat neutralization.
I also build production-grade web applications — from property rental platforms to QR-based loyalty systems — with a focus on clean architecture and real-world impact.
Offensive Security
DAST, Bug Bounty, OWASP Top 10, SSTI/SQLi/XSS/IDOR/SSRF/RCE/JWT
AI Integration
Google Vertex AI, Ollama (local LLMs), autonomous decision-making engines
Full-Stack Dev
Next.js, React, TypeScript, Python, Go, Flask, Supabase, Docker
Blue Team
Network monitoring, EDR, auto-remediation, SOC dashboards
What I've Built
procscope eBPF Tracer
Zero-Overhead Linux Runtime Investigation
eBPF-based tracer for malware triage and incident response. It follows a suspicious process at runtime, captures file, network, mount, and privilege activity, and ships with Debian packaging, DEP-8 autopkgtests, and distro submissions prepared for ParrotSec and BlackArch.
AegisFW
Zero-Trust LLM Firewall
Enterprise AI Gateway that intercepts GenAI requests, strips PII via Microsoft Presidio, and blocks semantic prompt injections in 40ms. Includes FinOps tracking and a CISO Dashboard.
Specter-OS
Autonomous AI Red Teaming Engine
Industry-leading framework for automated vulnerability discovery in AI Agents and LLM-powered systems. Orchestrates a 5-phase attack pipeline including goal hijacking and privilege escalation.
Specter-RAG
Neural Context Injection Engine
High-performance Retrieval-Augmented Generation (RAG) system. Uses vector-sharding and semantic search to provide AI agents with ultra-low latency access to vast knowledge bases.
Axon
Neural Security Evidence Backbone
High-performance sharded actor engine for security evidence normalization. Processes 1M findings/sec with zero-copy ingress and AI-powered remediation.
AuthSniper
AST-Driven BOLA/IDOR Hunter
Advanced Go tool for automated IDOR/BOLA detection. Uses Abstract Syntax Tree (AST) response comparisons to achieve a 0% false positive rate by ignoring dynamic noise.
Vex
Stateful API Logic Fuzzer
A zero-noise API fuzzer that hunts for logic flaws rather than syntax errors. Stateful session simulation for cross-user vulnerability hunting.
Aura
Sentient Offensive Engine
Autonomous AI-powered DAST framework that hunts, weaponizes, and reports vulnerabilities. Uses Google Vertex AI for strategic decision-making. Detects SQLi, XSS, SSTI, IDOR, SSRF, RCE, JWT abuse, BOLA, LFI, Open Redirect, and more.
Kharma Sentinel
Advanced Network Defense Suite
Real-time network monitor with Deep Packet Inspection, automated EDR via VirusTotal (70+ AV engines), MaxMind Geo-Intelligence, active threat neutralization, and Telegram breach alerts. Packaged as a standalone Windows `.exe`.
Nexus-CTF
Autonomous Exploitation Framework
AI-powered CTF framework with a local Ollama LLM brain (Cognitive Exploit Engine). Auto-detects and exploits SSTI, SQLi, XSS, and JWT vulnerabilities. Built for PicoCTF, HackTheBox, and custom labs.
CNE Family Official
Academic Networking Hub
The authoritative platform for BAU Computer & Network Engineering students. Features a real-time track manager, course materials, study plans, and academic tracking.
Reva Chalets
Property Rental Platform
Full-stack property rental web application with booking management, user authentication, mobile companion app, and Dockerized deployment. Deployed to Vercel with Prisma ORM for database management.
Café Rewards
QR-Based Loyalty System
Customer loyalty rewards platform with QR code scanning, points tracking, and reward redemption. Built with Vite + React + TypeScript and Supabase as the real-time backend.
Telegram Daily Bot
Scheduled Messaging Bot
24/7 Telegram bot deployed on Render cloud with Supabase persistence. Sends scheduled daily messages with state management across restarts.
Tech Stack
Languages
Security
AI & Machine Learning
Web & Frameworks
Infrastructure
Tools
Let's Work Together
Open to security engineering roles, bug bounty collaboration, full-stack development, and enterprise security consulting.
Enterprise Consulting
Custom integration of Kharma Sentinel, Aura, and other security frameworks into your corporate environment. Network auditing, threat response planning, and SOC dashboards.
Get a Quote →Penetration Testing
Manual and automated web application security assessments using my own toolchain (Aura DAST Framework). OWASP Top 10, API security, and bug bounty methodology.
Start a Project →Open Source Support
Kharma Sentinel has 5,400+ downloads. If it saved your team hours of work, consider sponsoring its continued development and new features.
☕ Sponsor →