Last 24 Hours · Global
2,200+
cyberattacks reported globally each day.
Source: Check Point Research, 2024.
Don’t be next → Contact Us
Est. 2016 · Middle East & USA

We Find
Vulnerabilities
Before Attackers Do.

3,000+ vulnerabilities disclosed across Apple, Meta, and U.S. federal programs. Adversary-emulated testing against the systems you actually ship.

Acknowledged by
AppleMetaGoogleLinkedInRevolutTikTokU.S. HHS
operator@semsec:~/apple-recon · zsh
53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20 53 45 4d 49 43 4f 4c 4f 4e 20 53 45 43 55 52 49 54 59 20 2d 2d 20 45 53 54 2e 20 32 30 31 36 20 2d 2d 20 4d 49 44 44 4c 45 20 45 41 53 54 20 26 20 55 53 41 20 2d 2d 20
01 / About

Security that holds up.
When it matters.

Web, mobile, and code security for enterprises, governments, and high-growth teams.

semsec.org/operations
Engagement Workspace
Sample dashboard · illustrative
IN PROGRESS
3
Critical
12
Findings
4
Engagements
68%
Remediated
Threat Activity · 24h↑ 12%vs avg
Active Engagements
Series-B fintechweb pentest · week 4/6
Enterprise retailermobile pentest · week 2/3
SaaS platformcode review · delivered
9:415G ●
SECURITY APPROVAL
Unusual login attempt
Frankfurt, DE · Tor exit node
YH
Y. Hassan
requested · just now
APPROVE
DENY
2016
founded · MENA + USA
100+
programs disclosed to
20+
certified specialists
< 24h
avg. response time
1,500+
engagements
2
continents · one team
02 / Recognition Network

Recognized.

100+ security programs.

LIVE LEDGER
│● CRIT● HIGH● MED│100+ programs40+ CVEs$1M+ bounties
[BBP]APPLE'24
[ACK]META'24
[BBP]GOOGLE'24
[HoF]LINKEDIN'23
[BBP]REVOLUT'24
[BBP]TIKTOK'23
[VDP]U.S. HHS'23
[BBP]MICROSOFT'24
[ACK]IBM'23
[BBP]AT&T'24
[CVD]VODAFONE'24
[BBP]OPENAI'24
[ACK]ADOBE'23
[BBP]SPOTIFY'24
[BBP]FORD'24
[HoF]UDEMY'23
[ACK]LOGITECH'23
[BBP]8X8'23
[ACK]STELLAR'24
[BBP]APPLE'24
[ACK]META'24
[BBP]GOOGLE'24
[HoF]LINKEDIN'23
[BBP]REVOLUT'24
[BBP]TIKTOK'23
[VDP]U.S. HHS'23
[BBP]MICROSOFT'24
[ACK]IBM'23
[BBP]AT&T'24
[CVD]VODAFONE'24
[BBP]OPENAI'24
[ACK]ADOBE'23
[BBP]SPOTIFY'24
[BBP]FORD'24
[HoF]UDEMY'23
[ACK]LOGITECH'23
[BBP]8X8'23
[ACK]STELLAR'24
[ACK]STELLAR'24
[BBP]8X8'23
[ACK]LOGITECH'23
[HoF]UDEMY'23
[BBP]FORD'24
[BBP]SPOTIFY'24
[ACK]ADOBE'23
[BBP]OPENAI'24
[CVD]VODAFONE'24
[BBP]AT&T'24
[ACK]IBM'23
[BBP]MICROSOFT'24
[VDP]U.S. HHS'23
[BBP]TIKTOK'23
[BBP]REVOLUT'24
[HoF]LINKEDIN'23
[BBP]GOOGLE'24
[ACK]META'24
[BBP]APPLE'24
[ACK]STELLAR'24
[BBP]8X8'23
[ACK]LOGITECH'23
[HoF]UDEMY'23
[BBP]FORD'24
[BBP]SPOTIFY'24
[ACK]ADOBE'23
[BBP]OPENAI'24
[CVD]VODAFONE'24
[BBP]AT&T'24
[ACK]IBM'23
[BBP]MICROSOFT'24
[VDP]U.S. HHS'23
[BBP]TIKTOK'23
[BBP]REVOLUT'24
[HoF]LINKEDIN'23
[BBP]GOOGLE'24
[ACK]META'24
[BBP]APPLE'24
// public ledger · updated weekly · 80+ disclosures unlisted under NDA
03 / Capabilities

Three disciplines.
One mission.

Every surface attackers see, tested before they get there.

03.1Web & API
http · api · graphql
03.2Mobile Apps
ios · android · frida
03.3Secure Code
sast · dast · review
// Web & API03.1

We probe what
attackers find.

Full-scope penetration testing against your web apps and APIs. Authentication, business logic, IDOR, SSRF, injection. We find them before someone with worse intentions does.

Engage Web Pentest →
POST api.bankcorp.com/v2/transferLIVE
▸ REQUEST231 bytes
POST /api/v2/transfer HTTP/1.1
Authorization: Bearer eyJhbGc...
{
"from": "acc_1234",
"amount": 1.00,
"to": "acc_9999' OR 1=1--"← injection
}
◾ RESPONSE · 200 OK1.4 kb
{
"order_id": "ord_9821",
"all_accounts": [ 50,000 records ] ← leaked
"admin_token": "tkn_xkj9..."
}
AUTH BYPASS + IDOR
CVSS 9.6 · CRITICAL
04 / Success Stories

Impact that ships
to production.

Our research has driven fixes in software used at global scale.

Apple
Apple
ACKNOWLEDGED

iOS Biometric Security Bypass

Reported a biometric bypass that could expose user photos. Apple fixed it in iOS 17.4.1 and credited the disclosure.

$50,000 Bounty
Recognition
Billions of users
Protected
U.S. HHS
U.S. HHS
FEDERAL DISCLOSURE

Healthcare Data Breach Prevention

Disclosed a federal healthcare flaw that could expose protected records. Handled through coordinated government channels.

Coordinated
Disclosure type
Millions of records
Secured
Meta
Meta
PRIVATE PROGRAM

Private Scraping Program Engagement

Invite-only Meta research focused on scraping risks, data leakage, and rapid remediation with Meta's security team.

Ongoing
Engagement status
3B+ accounts
Protected
05 / In the Media

Featured by 200+ media
outlets worldwide.

From local headlines to global tech press, our research makes the news.

L'Orient Today
L'ORIENT TODAY
Apr 2025

Semicolon receives $50,000 Apple bug bounty after helping fix vulnerability

Apple did not allow the team to disclose further technical details about the vulnerability

Read Article
AIT News
AIT NEWS
Feb 2023

Semicolon team reveals massive cyberattack targeting Telegram users in Lebanon

The attack could allow hackers to compromise accounts without requiring any interaction or communication from the user.

Read Article
Sky News Arabia
SKY NEWS ARABIA
Aug 2022

Lebanese researchers reported security flaws to Meta and won the Facebook prize

The flaws exposed users’ photos, phone numbers, and email addresses to the public.

Read Article
Al Arabiya
AL ARABIYA
Jan 2020

Semicolon uncovers critical Facebook vulnerability targeting politicians

The flaw could allow attackers to read and save messages exchanged between political advertisers and Facebook.

Read Article
06 / Global Presence

On stage at the
world's top conferences.

From Dubai to San Francisco, shaping the global security agenda.

DEF CON 33

United States
2025
Las Vegas, USA

Participation in events and Villages

Meta Conference

Japan
2025
Japan

Exclusive invite to Meta's security researchers conference

RSAC 2025

United States
2025
San Francisco, USA

Events and workshops participation

GITEX Global

Singapore
2025
Singapore

keynote speaker on the main stage

BSides

Czech Republic
2025
Prague

Ethical hacking activity participation

Meta Conference

South Africa
2024
South Africa

Exclusive invite to Meta's security researchers conference

Meta Conference

South Korea
2023
South Korea

Exclusive invite to Meta's security researchers conference

GISEC Global

United Arab Emirates
2023
Dubai, UAE

Conference activity participation

07 / Team

The people
behind the work.

Fayad A.
Fayad A.
Cybersecurity PM
Majd D.
Majd D.
Senior Security Researcher
Kassem B.
Kassem B.
Senior Security Researcher
Michel R.
Michel R.
Senior Red Teamer
Mohammad A.
Mohammad A.
Senior Penetration Tester
Bassem B.
Bassem B.
Senior Penetration Tester
Hassan Sh.
Hassan Sh.
Senior Penetration Tester
Ahmad M.
Ahmad M.
Senior Penetration Tester
Ali A.
Ali A.
Mobile Security Evaluator
Abed A.
Abed A.
Product Security Engineer

A senior team across offensive security, cloud, and governance.

Work with us →
08 / Get Started

Ready to find out
what attackers see?

From the team that helped make Apple, Meta, and the U.S. federal government more secure.

// Avg response time: <24 hours  ·  Middle East & USA operations