Security researcher who builds the systems he breaks.
Buy me a coffee
I work both sides of the wire. By day I build real-time backend systems - WebSockets, WebRTC, Go APIs, caching layers that hold up under fifteen thousand users. The rest of the time I take systems apart: bug bounties, CTFs, protocol internals.
Breaking things makes me a better builder. Every IDOR I've reported and every race condition I've chased down shapes how I design the next API. Currently studying Computer Science at Thapar Institute of Engineering and Technology, class of 2027.
Mar 2026 - Present
Real-time social platform - 180+ endpoints, 68K LOC, chat and P2P VoIP calling.
Built the real-time communication and caching layer with WebSockets, WebRTC, TURN servers, Bloom filters and TTL-based presence, supporting 15,000+ users on Dockerized AWS infrastructure with CI/CD.
Oct 2025 - Dec 2025
Full-stack product work on an Express.js codebase, remote.
Focused on web application security alongside feature delivery - the same instincts I use hunting bugs, pointed at code I was shipping myself.
Aug 2025 - Dec 2025
33 RESTful APIs in Go for secure authentication and authorization workflows.
Deployed on LAN infrastructure serving 5,000+ users with role-based access control.
Sixteen of my commits are in libssh's master branch - the SSH library shipping inside everything from KDE to Ansible to Cockpit. Seven contributions, upstreamed and released.
01
A guided, pentester-style network security assessment tool for Android.
The phone does 100% of the network I/O - discovery, enumeration, fingerprinting. The backend never touches a target; it's a pure correlation brain that ranks findings against vulnerability intelligence. SSRF-proof by construction.
02
A capture-the-flag competition disguised as a video game.
A 2D game built in Godot on a pixel-art map of Thapar University, where walking into a building drops you into a live CTF challenge. Go web server, WebRTC peer-to-peer between players, every challenge sandboxed in its own Docker container.
03
A SQL parser and storage engine written in C++.
Processes 2,000+ SQL commands per minute with file-backed CRUD operations, cutting database interaction latency by 40%. Parser hardened against injection following OWASP Top 10 - because of course it is.
A Python tool that extracts IPs from Shodan using arbitrary dorks - no subscription, no login. Recon means dozens of throwaway queries, and paying per query kills the exploratory instinct.
Distributed WPA handshake auditing: upload a capture, and a community of volunteered GPUs runs it against serious wordlists. The fastest way to learn whether a network's password was ever going to hold.
A unique URL that catches anything you send it and shows the full request in real time. Indispensable for testing callbacks and catching out-of-band interactions - SSRF and blind XSS don't confirm themselves.
The community's collective memory of payloads and bypasses, organized by vulnerability class. When a filter blocks the obvious approach, somebody here has already found the seventeen less obvious ones.
Date
Target
Finding
Sev
Ref
All findings reported responsibly. Nothing here shipped without a fix.
