I break application and infrastructure security for a living, and for fun. Six years in offensive security, currently doing product security full-time. Most of my public work is source-level vulnerability research — reading code until I find the bug, then building a proof that it is real.
| Identifier | Target | Class | Severity |
|---|---|---|---|
| CVE‑2026‑19264 | Postiz | Unauthenticated path traversal → full instance takeover technical writeup · advisory · CWE‑22 |
Critical 9.8 |
| GHSA‑6m2r‑wm6v‑c8qp | VNote | Argument injection → arbitrary command execution advisory · CWE‑88 |
High |
Further advisories are in coordinated disclosure and will be listed once public.
Papers — Growing Threats of Cyber Security: Protecting Yourself in a Digital World, IEEE ICNWC 2023.
|
Source-level audits Path traversal · injection · deserialization · authn/authz boundaries · SSRF · supply-chain and CI/CD attack paths Application & API IDOR · auth bypass · business logic · request smuggling · cache poisoning · OAuth and session handling |
AI & agent security Prompt injection and XPIA · agent tool-permission boundaries · MCP server security Red team & Active Directory Enumeration · privilege escalation · persistence · cross-trust and inter-forest attacks |
Also: Web3 contract auditing, Android/iOS assessment, cloud IAM and misconfiguration.
Prove it or drop it. Every report ships with a reliable, minimised PoC and a control case. No theoretical findings.
Vendor first. Coordinated disclosure, no deadlines, nothing published before a fix ships.
Root cause over symptom. A report should explain why the bug exists and what the correct fix is.
| Product Security Engineer | 2025 – present · remote |
| Security Engineer — Vault Infosec | 2024 – 2025 |
| Trainee Security Engineer — Auriseg | 2023 – 2024 |
Web, API, mobile and thick-client VAPT · network VA and configuration audits · secure source-code review, automated and manual · DevSecOps. Contributed to SEBI CSCRF and CERT‑In empanelled engagements.
Certifications — CRTP · PNPT · PT1 · eJPT · CEH Practical (17 total)
| CRTP | Certified Red Team Professional — Altered Security |
| PNPT | Practical Network Penetration Tester — TCM Security |
| PT1 | Jr Penetration Tester — TryHackMe |
| eJPT | eLearnSecurity Junior Penetration Tester |
| CEH (Practical) | EC-Council |
Community & CTF
- 🏆 1st place — Enigma Expedition 2024, ISACA Chennai Chapter · Team Dark Vengeance
- 🥇 ServiceNow CTF winner · CloudSEK top 3 — NULLCON Goa 2025
- 🎤 Member, BSides Bangalore · organiser, CyberHawkCTF 2023 (published TryHackMe room)
- 📍 VulnCon · BSides Bangalore & Ahmedabad · NULLCON Goa · Seasides · CSA Bangalore · ISACA Chennai · CSEC Chennai
Burp Suite Pro Ghidra Frida Objection MobSF jadx Foundry Semgrep Checkmarx nuclei Nessus Nmap Wireshark
Python Go Rust TypeScript Solidity Bash
