Farhan Almutairi

Security Engineer & Bug Bounty Researcher | InfoSec, AppSec, & AI Security | Founder of CarbonFlow

Al Majma'ah, Saudi Arabia
See the Project in Action Open Full CV

Live Demo

CarbonFlow - Self-Hosted AI Security & Automation Systems

A self-hosted AI security and automation system built to keep sensitive execution under control.

Professional Bio

I am a cybersecurity engineer and system builder specializing in secure AI infrastructure. In a market where many AI portfolios stop at simple chatbots and dashboards, I focus on building an AI execution layer that puts security and control first. My work bridges bug bounty research, application security, Data Loss Prevention (DLP), local LLM routing, and tamper-proof audit trails to create practical, verifiable, and secure systems.

I am also an active researcher on the Saudi national bug bounty platform, with documented findings including CSRF, Open Redirect with WAF bypass, sensitive information disclosure, and access control flaws. Technical details and targets are intentionally withheld in compliance with coordinated disclosure policies.

The AI Security Gap: Automation Without Losing Control

Small teams need the speed of AI automation, but relying on scattered SaaS tools and opaque workflows often risks exposing sensitive commands, API keys, customer data, or internal context. Traditional dashboards do not solve the core issue: how to automate while proving what happened, preventing leaks, and maintaining ownership of the execution layer.

CarbonFlow addresses this gap by treating AI automation as a governed system, not just a scattered set of prompts. It combines data classification, secure routing, auditability, runtime detection, and local/cloud decision boundaries so organizations can move fast without compromising control.

CarbonFlow doesn't just make AI workflows faster; it makes them accountable.

- Farhan Almutairi

The Solution

CarbonFlow - Self-Hosted AI Security & Automation Systems

CarbonFlow is a suite of self-hosted AI governance and security systems built around practical defenses: SAST, DLP, EDR, prompt injection defense, licensing, compliance, audit logs, and automation. The goal is simple: enable business growth through AI while preventing sensitive data leaks and maintaining verifiable control.

CarbonFlow live public site screenshot
01
Security-First AI GatewayA DLP engine sanitizes PII, API keys, and payment data before requests ever reach external AI services.
02
Verifiable ExecutionEd25519 signatures, hash-chain logs, HMAC audit logs, and SHA-256 integrity checks maintain complete trust.
03
Self-Hosted AutomationDocker, Linux hardening, and sovereign local-to-cloud routing reduce third-party dependency risks.
04
Proven Security MethodologyBuilt on bug bounty research, OWASP Top 10, CWE/CVE analysis, CVSS scoring, and secure code reviews.

The Biggest Challenge

The biggest challenge was figuring out how to leverage AI automation without losing control over execution. I had to design gateways that detect command injections, sanitize sensitive inputs, and log decisions, all while keeping the system fast and usable for real-world workflows.

How I Overcame It

1
Granular Self-Hosted ControlsI built DLP, request size limits, constant-time API key authentication, and structured metrics directly into the services.
2
Aligning with Industry StandardsI utilized OWASP, CWE, CVE/NVD analysis, and CVSS scoring to ensure the project tackles real-world security threats.
3
Built-in AuditabilityI implemented signed logs and file integrity monitoring so the execution history can always be verified later.

Tech Stack

PythonRustNode.js / TypeScriptDockerCloudflareAlpine LinuxEd25519OWASP LLM Top 10CWE / CVESQLBash
CarbonFlow architecture and automation flow
Architecture flow: public surface, automation layer, local AI routing, governance, and signed evidence.

Who Benefits

Founders, small businesses, security teams, and AI builders who need practical automation without handing over sensitive data and operational control to third-party platforms. CarbonFlow is especially beneficial for teams seeking AI-driven growth, security visibility, and bilingual workflows ready for the MENA region while retaining full ownership of their data and infrastructure.

What's Next

01
Productizing the AI Execution LayerPreparing workflows, dashboards, and secure action gateways for local enterprises.
02
Deeper Sovereign AI RoutingRouting sensitive tasks locally and allowing secure cloud escalation only when data is fully sanitized.
03
Expanding Security VerificationBroadening the coverage of automated tests, detection rules, and tamper-proof evidence across every microservice.

Technical Competencies

Technical Competencies & Skills

Skills extracted from my professional journey and proven through CarbonFlow, security research, and self-hosted AI systems.

Export CV PDF

Offensive Security & Testing

Validated bug bounty work and coordinated disclosure experience.

  • Vulnerability Assessment
  • Bug Bounty
  • OWASP Top 10
  • CSRF
  • Open Redirect
  • WAF Bypass
  • Broken Access Control
  • API Security
  • CVSS
  • CWE / CVE Analysis

AppSec & Product Security

Secure-by-design engineering for AI and application systems.

  • SAST
  • Secure Code Review
  • AST Analysis
  • Secrets Detection
  • DLP
  • PII Redaction
  • Secure API Design
  • Prompt-Injection Defense
  • OWASP LLM Top 10

Security Operations & Detection

Runtime detection and verifiable logging patterns.

  • Runtime Threat Detection
  • EDR
  • Sigma Rules
  • YARA-style Rules
  • SHA-256 Integrity
  • Structured Logging
  • Metrics
  • HMAC Ledgers
  • Ed25519 Signatures

Infrastructure & Scripting

Hands-on implementation across security, automation, and self-hosted AI infrastructure.

  • Linux / Alpine Hardening
  • SSH Key Management
  • Docker
  • Cloudflare
  • Network / Edge Security
  • Data Classification
  • Python
  • Rust
  • Node.js / TypeScript
  • Bash
  • SQL

AI Security

Agent governance, LLM output verification, sovereign local/cloud routing, and sensitive data leak prevention.

Agent Governance LLM Output Verification Sovereign Routing Zero Sensitive-Data Leakage

Professional Experience

2024 - Present

Founder & Security Engineer - CarbonFlow

Self-Hosted AI & Security Systems | Al Majma'ah, Saudi Arabia (Remote)

  • Built 22 self-hosted microservices for AI security and governance, including SAST, DLP, EDR, prompt injection defense, licensing, and compliance.
  • Maintained a 100% pass rate across 353 automated tests, featuring constant-time API key authentication, request limits, structured logging, and metrics.
  • Developed a DLP gateway that sanitizes PII, API keys, and payment data before external AI requests, achieving 0 leaks across 47,000 scans.
  • Built a source and binary SAST scanner using AST analysis and CWE mapping, verified against 12,000 CVEs from the NVD.
  • Created tamper-proof audit trails across services using Ed25519-signed logs and hash-chains.
  • Operated a hardened, self-hosted edge server using Alpine Linux, Docker containers, SSH key verification, permission trees, and SHA-256 file integrity monitoring.
  • Conducted authorized security research via bugbounty.sa, reporting medium-severity vulnerabilities to major telecom and ISP entities.

Core Projects

Real Systems, Not Just Pitch Decks

A brief map of the core projects in my portfolio.

AL-MUNAA — Collective Immune System for AI Agents (OpenAI Build Week)

A novel Threat Antibody Protocol: when one agent detects a prompt-injection attack it emits a signed, privacy-safe HMAC "antibody" that other agents in the same trust family verify to block mutated attacks — without exposing the original secret. 74 tests passing; calibrated matcher 4/4 attacks, 0/5 false positives. Built test-first with Codex (GPT-5.6). github.com/Farhanward/al-munaa

kashif (SAST Scanner)

Scans source code and binaries using AST analysis and CWE mapping; verified against 12,000 NVD CVEs.

alwaseet (DLP / AI Gateway)

Sanitizes PII and API/payment keys before cloud AI requests; achieved 0 leaks across 47,000 scans.

almunaa & aegis (Agent Security)

Prompt injection defense with 98% F1-score, featuring verifiable action gateways and Ed25519 hash-chain logging with 92% F1-score.

alain_alsahira & alqofl

Lightweight EDR with Sigma/YARA-style rules and serverless Ed25519 licensing; benchmarked 12K licenses and detected 705/705 tamper attempts.

CarbonFlow & ZEED

A live edge system for AI automation and a self-hosted RAG system with a Qdrant knowledge base containing 781K vectors on a single GPU.

Bug Bounty Research

Documented findings under coordinated disclosure, including CSRF, Open Redirect with WAF bypass, sensitive info disclosure, and access control flaws.

Info-Stealer Incident Response & Malware Analysis

End-to-end analysis of a real info-stealer intrusion: identified Trojan:Win32/Malgent, mapped the kill chain to MITRE ATT&CK, extracted IOCs (forged code-signing cert, timestomping), and executed containment and hardening — verified clean with Sysinternals autorunsc.

Certifications & Training

Tuwaiq Academy — SATR e-Learning Platform (2026) · a 23-module curriculum across 5 tracks

  • Mobile Dev (Android/Kotlin): Kotlin 101–104 · Android 101–103 · Jetpack Compose · Firebase (Fundamentals + Android) · Dart 101
  • Python Programming: Python 101–104
  • Databases & SQL: SQL 101–103
  • Data Science & Analysis: Intro to Data Science · Data Processing with NumPy
  • Software Engineering: Git Fundamentals · Unit Testing 101–102

Education & Certifications

Health Informatics Technician — Diploma (2010)

  • Arabic (Native)
  • English (Professional Working Proficiency)

Let's Connect

Secure AI systems need builders who can prove their work. Let's build something impactful.

Email: [email protected] | Phone: +966 50 421 1844

Email LinkedIn GitHub Bug Bounty Profile CarbonFlow

Al Majma'ah, Saudi Arabia · +966 50 421 1844 · [email protected]