Ziad_Abdelgwad/ghaymah-CLI-v2_test
1
0
نسخ 0
الشفرة المشكلات طلبات السحب Actions Packages المشاريع الإصدارات الويكي النشاط

🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository

تصفح المصدر 
Comprehensive security audit of the Ghaymah CLI v2 and web platform.

Findings:
  - [CRITICAL] T1552: Dockerfile & .env Credential Leakage
  - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change
  - [HIGH]     T1539: Session Token Revocation Bypass
  - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang)

Includes:
  - 8 Proof-of-Concept applications (PoC_Apps/)
  - Visual evidence & screenshots (Assets/Screenshots/)
  - Full PDF audit report (Reports/)
  - Mermaid.js attack flow diagrams in README

Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
هذا الالتزام موجود في:
Ziad Mahmoud Ahmed Abdelgwad
2026-08-19 17:56:11 +00:00
التزام a7a479141b
25 ملفات معدلة مع 1029 إضافات و0 حذوفات
تنزيل ملف التصحيح تنزيل ملف الاختلاف توسيع جميع الملفات طي جميع الملفات

548
README.md Normal file
عرض الملف

@@ -0,0 +1,548 @@
<!-- ═══════════════════════════════════════════════════════════════════════════
Ghaymah CLI v2 — Security & QA Audit Repository
Author: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist
═══════════════════════════════════════════════════════════════════════════ -->
<div align="center">
<!-- ─── Animated SVG Badges ──────────────────────────────────────────────── -->
[![Security Audit](https://img.shields.io/badge/Security_Audit-Completed-critical?style=for-the-badge&logo=hackthebox&logoColor=white&labelColor=0D1117&color=FF4444)](.)
[![MITRE ATT&CK](https://img.shields.io/badge/MITRE_ATT%26CK-Mapped-blue?style=for-the-badge&logo=target&logoColor=white&labelColor=0D1117&color=4A90D9)](https://attack.mitre.org)
[![Docker](https://img.shields.io/badge/Docker-Tested-blue?style=for-the-badge&logo=docker&logoColor=white&labelColor=0D1117&color=2496ED)](.)
[![Linux](https://img.shields.io/badge/Linux-amd64-yellow?style=for-the-badge&logo=linux&logoColor=white&labelColor=0D1117&color=FCC624)](.)
[![Platform](https://img.shields.io/badge/Platform-Web_&_CLI-green?style=for-the-badge&logo=gnubash&logoColor=white&labelColor=0D1117&color=00C853)](.)
<br/>
<!-- ─── Header Title Block ───────────────────────────────────────────────── -->
<img src="https://readme-typing-svg.demolab.com?font=JetBrains+Mono&weight=800&size=36&duration=3000&pause=1000&color=FF4444&center=true&vCenter=true&multiline=true&repeat=true&width=900&height=100&lines=%F0%9F%9B%A1%EF%B8%8F+Ghaymah+CLI+v2+%E2%80%94+Security+Audit;Vulnerability+Research+%26+Penetration+Testing" alt="Typing SVG" />
<br/>
```
╔═══════════════════════════════════════════════════════════════════╗
║ ║
║ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗███╗ ███╗ █████╗ ██╗ ██╗ ║
║ ██╔════╝ ██║ ██║██╔══██╗╚██╗ ██╔╝████╗ ████║██╔══██╗██║ ██║ ║
║ ██║ ███╗███████║███████║ ╚████╔╝ ██╔████╔██║███████║███████║ ║
║ ██║ ██║██╔══██║██╔══██║ ╚██╔╝ ██║╚██╔╝██║██╔══██║██╔══██║ ║
║ ╚██████╔╝██║ ██║██║ ██║ ██║ ██║ ╚═╝ ██║██║ ██║██║ ██║ ║
║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ║
║ ║
║ S E C U R I T Y A U D I T R E P O R T ║
║ CLI v2 + Platform ║
║ ║
╚═══════════════════════════════════════════════════════════════════╝
```
<br/>
<a href="https://app.gitpasha.com/Ziad_Abdelgwad/ghaymah-CLI-v2_test"><img src="https://img.shields.io/badge/Repository-GitPasha-181717?style=flat-square&logo=git&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Report_Date-August_2026-0D1117?style=flat-square&logo=calendar&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Findings-4_Vulnerabilities-FF4444?style=flat-square&logo=bugcrowd&logoColor=white" /></a>
<a href="#"><img src="https://img.shields.io/badge/Status-Report_Delivered-00C853?style=flat-square&logo=checkmarx&logoColor=white" /></a>
</div>
---
<br/>
## 👤 Lead Auditor
<table>
<tr>
<td width="80" align="center">
<img src="https://img.shields.io/badge/🛡️-Lead_Auditor-FF4444?style=for-the-badge&labelColor=0D1117" />
</td>
<td>
**Ziad Mahmoud Ahmed Abdelgwad**
*Cybersecurity Specialist — Penetration Testing & Infrastructure Security*
<a href="https://github.com/ZiadMahmoud2003"><img src="https://img.shields.io/badge/GitHub-ZiadMahmoud2003-181717?style=flat-square&logo=github&logoColor=white" /></a>
<a href="https://app.gitpasha.com/Ziad_Abdelgwad"><img src="https://img.shields.io/badge/GitPasha-Ziad__Abdelgwad-181717?style=flat-square&logo=git&logoColor=white" /></a>
</td>
</tr>
</table>
---
<br/>
## 📋 Executive Summary
> **Scope:** Full-stack security assessment of the **Ghaymah CLI v2** command-line tool and its backing **web platform**, covering Docker container infrastructure, authentication mechanisms, session management, and CI/CD pipeline resilience.
This audit identified **4 distinct vulnerability classes** across the CLI tool's deployment pipeline and the platform's authentication layer. Findings range from **Critical** credential exposure through Dockerfile/`.env` leakage to **High-severity** session management flaws and **Medium** denial-of-service vectors via configuration poisoning.
The assessment leveraged real PoC applications deployed through the Ghaymah CLI to validate each finding under production-equivalent conditions on a Linux amd64 target.
| Metric | Value |
|:---|:---|
| **Total Findings** | `4` |
| **Critical** | `2` |
| **High** | `1` |
| **Medium / High** | `1` |
| **PoC Apps Created** | `8` |
| **Audit Duration** | `1 Day (Intensive)` |
| **Methodology** | `MITRE ATT&CK`, `OWASP Top 10` |
---
<br/>
## ⚠️ Findings Dashboard
<div align="center">
<!-- ─── Severity Legend ────────────────────────────────────────────────── -->
![Critical](https://img.shields.io/badge/●_CRITICAL-FF0000?style=flat-square&labelColor=FF0000)
![High](https://img.shields.io/badge/●_HIGH-FF6600?style=flat-square&labelColor=FF6600)
![Medium](https://img.shields.io/badge/●_MEDIUM-FFAA00?style=flat-square&labelColor=FFAA00)
</div>
<br/>
<table>
<thead>
<tr>
<th width="40" align="center">#</th>
<th width="120" align="center">Severity</th>
<th width="160">MITRE ID</th>
<th>Finding Title</th>
<th width="110" align="center">Target</th>
</tr>
</thead>
<tbody>
<tr>
<td align="center"><b>1</b></td>
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
<td><code>T1552</code></td>
<td><b>Dockerfile & <code>.env</code> Credential Leakage</b> — Sensitive environment variables and secrets are embedded in Dockerfiles and <code>.env</code> files, persisted in image layers and accessible post-deployment.</td>
<td align="center"><code>CLI</code></td>
</tr>
<tr>
<td align="center"><b>2</b></td>
<td align="center"><img src="https://img.shields.io/badge/-CRITICAL-FF0000?style=flat-square" /></td>
<td><code>OWASP A07</code></td>
<td><b>Missing OTP & Unverified Password Change</b> — The web platform allows password changes without OTP/2FA verification, enabling account takeover via session hijacking or CSRF.</td>
<td align="center"><code>Web</code></td>
</tr>
<tr>
<td align="center"><b>3</b></td>
<td align="center"><img src="https://img.shields.io/badge/-HIGH-FF6600?style=flat-square" /></td>
<td><code>T1539</code></td>
<td><b>Session Token Revocation Bypass</b> — After password change or logout, session tokens remain valid and can be reused to maintain unauthorized access.</td>
<td align="center"><code>Web</code></td>
</tr>
<tr>
<td align="center"><b>4</b></td>
<td align="center"><img src="https://img.shields.io/badge/-MEDIUM/HIGH-FFAA00?style=flat-square" /></td>
<td><code>CWE-400</code></td>
<td><b>Configuration Poisoning — DoS Pipeline Hang</b> — Injecting malformed environment variables causes the backend worker to crash, hanging the entire build/deploy pipeline indefinitely.</td>
<td align="center"><code>CLI</code></td>
</tr>
</tbody>
</table>
---
<br/>
## 🔬 Vulnerability Deep-Dive
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 1 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🔴 FINDING 1 — T1552: Dockerfile & <code>.env</code> Credential Leakage</b></summary>
<br/>
### Overview
The Ghaymah CLI packages application source code—including `.env` files and Dockerfiles containing hardcoded secrets—directly into the container image. These artifacts persist across image layers and are trivially extractable by any entity with access to the image or registry.
### Impact
- **Credential Theft:** API keys, database passwords, and service tokens can be extracted from any pulled image.
- **Lateral Movement:** Leaked credentials may grant access to adjacent infrastructure components.
- **Supply Chain Risk:** Downstream consumers of the image inherit the exposed secrets.
### Evidence
| Artifact | Description |
|:---|:---|
| `Assets/Screenshots/env.png` | Screenshot showing `.env` file with credentials embedded in image |
| `Assets/Screenshots/docker.png` | Screenshot showing Dockerfile with exposed build arguments |
| `PoC_Apps/test-app/` | PoC application demonstrating the leakage |
### Remediation
```
1. Use Docker BuildKit secrets: --mount=type=secret,id=myenv
2. Add .env to .dockerignore in the CLI scaffolding
3. Inject secrets at runtime via orchestrator (K8s Secrets / Vault)
4. Implement image scanning in CI (Trivy, Grype)
```
</details>
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 2 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🔴 FINDING 2 — OWASP A07: Missing OTP & Unverified Password Change</b></summary>
<br/>
### Overview
The Ghaymah web platform allows authenticated users to change their password without requiring the current password, an OTP challenge, or any secondary verification. This undermines the entire authentication chain.
### Impact
- **Account Takeover:** An attacker with a stolen session token can silently change the victim's password and lock them out.
- **Privilege Escalation:** Combined with Finding 3, a single leaked token grants permanent account control.
- **Compliance Violation:** Fails OWASP ASVS v4.0 §2.2 and NIST SP 800-63B requirements.
### Attack Flow
```
Attacker steals session token (XSS/Network sniff)
└──▶ Calls password change API (no OTP required)
└──▶ Sets new password
└──▶ Original user locked out permanently
```
### Remediation
```
1. Require current password + OTP for any credential change
2. Implement rate limiting on password change endpoints
3. Send email/SMS notification on password change events
4. Invalidate all existing sessions after password change
```
</details>
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 3 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🟠 FINDING 3 — T1539: Session Token Revocation Bypass</b></summary>
<br/>
### Overview
Session tokens issued by the Ghaymah platform are not invalidated upon logout or password change. A captured token remains valid and usable indefinitely until its natural expiry.
### Impact
- **Persistent Unauthorized Access:** Attackers can maintain access even after the user changes their password or explicitly logs out.
- **Audit Trail Corruption:** Legitimate user and attacker actions become indistinguishable.
### Evidence
| Artifact | Description |
|:---|:---|
| `Assets/Screenshots/Screenshot_2026-08-19_163341.png` | Session validity after logout |
| `Assets/Screenshots/Screenshot_2026-08-19_163501.png` | Token reuse after password change |
### Remediation
```
1. Implement server-side session store (Redis) with explicit revocation
2. Rotate tokens on privilege-level changes (password change, role update)
3. Set short-lived access tokens (15 min) with refresh token rotation
4. Maintain a token deny-list for immediate revocation
```
</details>
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<!-- FINDING 4 -->
<!-- ═══════════════════════════════════════════════════════════════════════ -->
<details>
<summary><b>🟡 FINDING 4 — CWE-400: Configuration Poisoning — DoS Pipeline Hang</b></summary>
<br/>
### Overview
The Ghaymah CLI's deployment pipeline does not validate environment variable values before passing them to the backend build worker. Injecting malformed or adversarial values (e.g., multi-line strings, shell metacharacters, excessively long values) causes the worker process to crash or enter an infinite loop, hanging the entire pipeline.
### Impact
- **Denial of Service:** The user's deployment pipeline becomes permanently stuck.
- **Resource Exhaustion:** Backend workers consume resources without releasing them.
- **No Recovery Path:** Users cannot cancel or restart the hung pipeline from the CLI.
### Architecture / Flow Graph
```mermaid
flowchart TB
subgraph CLIENT ["🖥️ Client Machine"]
A["fa:fa-terminal <b>gy deploy</b><br/>User runs CLI command"]
B["fa:fa-file-code <b>.env / .gy.json</b><br/>Config with malformed vars"]
end
subgraph GHAYMAH_API ["☁️ Ghaymah Backend"]
C["fa:fa-server <b>API Gateway</b><br/>Receives deploy request"]
D["fa:fa-cogs <b>Build Worker</b><br/>Parses env variables"]
E["fa:fa-docker <b>Docker Builder</b><br/>Builds container image"]
end
subgraph FAILURE ["💀 Failure State"]
F["fa:fa-bomb <b>Worker Crash</b><br/>Malformed input causes panic"]
G["fa:fa-hourglass-end <b>Pipeline Hang</b><br/>Indefinite wait state"]
H["fa:fa-ban <b>DoS Achieved</b><br/>No deploy / no cancel"]
end
A -->|"1. Reads config"| B
B -->|"2. Sends payload<br/>(unvalidated)"| C
C -->|"3. Dispatches job"| D
D -->|"4. ✅ Normal flow"| E
D -->|"4. ❌ Malformed input"| F
F -->|"5. No error propagation"| G
G -->|"6. User stuck"| H
style CLIENT fill:#1a1a2e,stroke:#00C853,stroke-width:2px,color:#FFFFFF
style GHAYMAH_API fill:#1a1a2e,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
style FAILURE fill:#1a1a2e,stroke:#FF4444,stroke-width:2px,color:#FFFFFF
style A fill:#0D1117,stroke:#00C853,color:#FFFFFF
style B fill:#0D1117,stroke:#FFAA00,color:#FFFFFF
style C fill:#0D1117,stroke:#4A90D9,color:#FFFFFF
style D fill:#0D1117,stroke:#4A90D9,color:#FFFFFF
style E fill:#0D1117,stroke:#00C853,color:#FFFFFF
style F fill:#0D1117,stroke:#FF4444,color:#FFFFFF
style G fill:#0D1117,stroke:#FF4444,color:#FFFFFF
style H fill:#0D1117,stroke:#FF0000,color:#FFFFFF
```
### Proof of Concept
The following PoC apps demonstrate this attack:
| PoC App | Purpose |
|:---|:---|
| `PoC_Apps/broken-docker-test/` | Intentionally broken Dockerfile to test error handling |
| `PoC_Apps/invalid-docker-test/` | Invalid Docker configuration causing pipeline hang |
| `PoC_Apps/test-app-3/` | Malformed env variable injection test |
| `PoC_Apps/test-app-5/` | Extended poisoning test with edge-case values |
### Evidence
| Artifact | Description |
|:---|:---|
| `Assets/Screenshots/logs.png` | Backend logs showing worker crash and hang state |
### Remediation
```
1. Validate all env variable keys/values against a strict schema
2. Implement build timeouts (max 10 min) with automatic cleanup
3. Add a "cancel deployment" feature to the CLI and API
4. Sanitize inputs: reject multi-line values, shell metacharacters, >4KB values
5. Return structured errors to the CLI on worker failure
```
</details>
---
<br/>
## 🔀 Attack Surface Architecture
> Complete Mermaid.js diagram mapping the audit scope, attack vectors, and affected components.
```mermaid
flowchart LR
subgraph SCOPE ["🎯 Audit Scope"]
direction TB
CLI["fa:fa-terminal <b>Ghaymah CLI v2</b><br/>gy-linux-amd64"]
WEB["fa:fa-globe <b>Web Platform</b><br/>Dashboard & API"]
end
subgraph VECTORS ["⚔️ Attack Vectors"]
direction TB
V1["T1552<br/>Credential Leakage"]
V2["T1539<br/>Session Bypass"]
V3["CWE-400<br/>Config Poisoning"]
V4["OWASP A07<br/>Auth Failure"]
end
subgraph IMPACT ["💥 Impact"]
direction TB
I1["🔑 Secret Exposure"]
I2["👤 Account Takeover"]
I3["⛔ Pipeline DoS"]
end
CLI --> V1
CLI --> V3
WEB --> V2
WEB --> V4
V1 --> I1
V2 --> I2
V3 --> I3
V4 --> I2
style SCOPE fill:#0D1117,stroke:#4A90D9,stroke-width:2px,color:#FFFFFF
style VECTORS fill:#0D1117,stroke:#FF6600,stroke-width:2px,color:#FFFFFF
style IMPACT fill:#0D1117,stroke:#FF0000,stroke-width:2px,color:#FFFFFF
style CLI fill:#1a1a2e,stroke:#00C853,color:#FFFFFF
style WEB fill:#1a1a2e,stroke:#4A90D9,color:#FFFFFF
style V1 fill:#1a1a2e,stroke:#FF0000,color:#FFFFFF
style V2 fill:#1a1a2e,stroke:#FF6600,color:#FFFFFF
style V3 fill:#1a1a2e,stroke:#FFAA00,color:#FFFFFF
style V4 fill:#1a1a2e,stroke:#FF0000,color:#FFFFFF
style I1 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
style I2 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
style I3 fill:#1a1a2e,stroke:#FF4444,color:#FFFFFF
```
---
<br/>
## 📁 Repository Structure
```
ghaymah-v2-test/
│
├── 📂 Assets/
│ └── 📂 Screenshots/ # Visual evidence & proof captures
│ ├── docker.png # Dockerfile credential exposure
│ ├── env.png # .env file leakage in image layers
│ ├── logs.png # Backend worker crash logs
│ ├── Screenshot_*.png # Session management bypass evidence
│ └── ...
│
├── 📂 PoC_Apps/ # Proof-of-Concept applications
│ ├── 📂 test-app/ # Initial recon & .env leak PoC
│ ├── 📂 test-app-2/ # RCE boundary testing (auto_rce_test.sh)
│ ├── 📂 test-app-3/ # Malformed env variable injection
│ ├── 📂 test-app-5/ # Extended config poisoning tests
│ ├── 📂 test-app-clean/ # Baseline clean deployment
│ ├── 📂 test-app-final/ # Final validated Dockerfile
│ ├── 📂 broken-docker-test/ # Intentionally broken Docker config
│ └── 📂 invalid-docker-test/ # Invalid config → pipeline hang PoC
│
├── 📂 Reports/
│ └── 📄 Ghaymah_CLI_v2_Audit_Report.pdf # Full audit report (PDF)
│
├── 📄 .gitignore # Ignores binary, .env, OS artifacts
├── 📄 organize.sh # Workspace organization script
└── 📄 README.md # ← You are here
```
---
<br/>
## 🧪 PoC Navigation Guide
<details>
<summary><b>📂 How to reproduce the findings</b></summary>
<br/>
Each folder inside `PoC_Apps/` is a standalone application that was deployed through the Ghaymah CLI to validate a specific vulnerability. They are ordered chronologically by testing phase:
### Phase 1 — Reconnaissance & Credential Leakage
| Folder | Purpose | Related Finding |
|:---|:---|:---|
| `test-app/` | Initial deployment with `.env` file containing test credentials. Demonstrates that secrets persist in image layers. | Finding 1 (T1552) |
| `test-app-2/` | Includes `auto_rce_test.sh` — automated script probing for command injection boundaries in the build pipeline. | Exploratory |
### Phase 2 — Configuration Poisoning & DoS
| Folder | Purpose | Related Finding |
|:---|:---|:---|
| `test-app-3/` | Dockerfile with malformed `ENV` directives to test input validation on the backend worker. | Finding 4 (CWE-400) |
| `test-app-5/` | Extended poisoning tests: multi-line values, special characters, oversized payloads. | Finding 4 (CWE-400) |
| `broken-docker-test/` | Intentionally invalid Dockerfile to test error handling and pipeline recovery. | Finding 4 (CWE-400) |
| `invalid-docker-test/` | Invalid Docker configuration that triggers a permanent pipeline hang. | Finding 4 (CWE-400) |
### Phase 3 — Validation & Baseline
| Folder | Purpose | Related Finding |
|:---|:---|:---|
| `test-app-clean/` | Clean deployment with no malicious payloads — establishes a working baseline. | Baseline |
| `test-app-final/` | Final validated Dockerfile confirming the minimal reproducible deployment. | Baseline |
> **Note:** Findings 2 (OWASP A07) and 3 (T1539) target the **web platform** and were validated via browser-based testing and API calls, not via PoC apps.
</details>
---
<br/>
## 📊 Methodology
<details>
<summary><b>🔍 Testing Methodology & Frameworks</b></summary>
<br/>
| Framework | Application |
|:---|:---|
| **MITRE ATT&CK** | Technique mapping for CLI-side findings (T1552, T1539) |
| **OWASP Top 10 (2021)** | Web platform assessment (A07: Identification & Authentication Failures) |
| **OWASP ASVS v4.0** | Authentication & session management verification |
| **CWE/CVSS** | Vulnerability classification & severity scoring |
| **Manual Testing** | Custom PoC development, API fuzzing, Docker image inspection |
### Tools Used
- `gy-linux-amd64` — Ghaymah CLI v2 binary (target under test)
- `docker` — Container runtime for image inspection & layer analysis
- Browser DevTools — Session token inspection & API testing
- Custom shell scripts — Automated RCE boundary testing
</details>
---
<br/>
## 📎 Full Report
The comprehensive audit report with detailed technical analysis, risk ratings, and remediation roadmap is available as a PDF:
<div align="center">
📄 **[`Reports/Ghaymah_CLI_v2_Audit_Report.pdf`](./Reports/Ghaymah_CLI_v2_Audit_Report.pdf)**
</div>
---
<br/>
## ⚖️ Disclaimer
> This security audit was conducted in a controlled testing environment with explicit authorization. All findings are reported responsibly to the platform maintainers. The PoC applications and scripts in this repository are provided for **educational and verification purposes only**. Unauthorized use of these techniques against systems you do not own or have permission to test is **illegal and unethical**.
---
<div align="center">
<br/>
<img src="https://img.shields.io/badge/Crafted_with-Precision_&_Purpose-0D1117?style=for-the-badge&logo=shield&logoColor=FF4444" />
<br/><br/>
**Ziad Mahmoud Ahmed Abdelgwad**
*Cybersecurity Specialist*
<br/>
<a href="https://github.com/ZiadMahmoud2003"><img src="https://img.shields.io/badge/GitHub-ZiadMahmoud2003-181717?style=for-the-badge&logo=github&logoColor=white" /></a>
&nbsp;
<a href="https://app.gitpasha.com/Ziad_Abdelgwad"><img src="https://img.shields.io/badge/GitPasha-Ziad__Abdelgwad-181717?style=for-the-badge&logo=git&logoColor=white" /></a>
<br/><br/>
<sub>© 2026 — All rights reserved. Conducted under responsible disclosure principles.</sub>
</div>