Research paper
Wild Animal Detection using YOLOv8
Read the paper- Best Research PaperAwarded by CHARUSAT.
- Times of IndiaFeatured on the front page, February 2024.
I find security problems, then help fix them.
I'm a security engineer in Ahmedabad, India. I test web and mobile products at work, look for bugs in open-source projects in my own time, and report what I find to the people who maintain the code.
70+ Subdomains reviewed checked for weak points
3 Security bugs reported all fixed by the maintainers
10% Global rank on TryHackMe hands-on practice platform
6 Systems built apps and delivery infrastructure
I started out testing web applications and APIs — checking who can get to what, and showing what happens when those checks fail.
That changed how I build. The bugs I found became the things I now design against: safer defaults, tighter permissions, and checks that run on their own instead of relying on someone remembering.
Today I test internal products at work, research open-source projects on the side, and write the rules that decide what is allowed to run on our Kubernetes clusters.
What I work with
- Use regularly
- Can work with
- Learning
Finding weak points
- Attack-surface mapping
- OWASP
- MITRE ATT&CK
- Threat modeling
Security testing
- API security
- Burp Suite
- Nmap
- Nuclei
- Wireshark
Building software
- Java
- Python
- Spring Security
- OAuth2 / OIDC
- JWT / RBAC
- SQL / MongoDB
Shipping and automation
- Git
- OPA Gatekeeper
- Docker
- Jenkins
- Kubernetes
- Trivy / SAST / DAST
- Terraform
Running systems safely
- Rate limiting
- Microservice resilience
- Least privilege
- AWS foundations
- Falco
- CKS
Security bugs I've reported
CVE-2026-61549 Unrestricted workload identity in Kubernetes backend High · 7.5
pipeline YAML→serviceAccountName→privileged pod identity
- What was assumed
- A pipeline author could safely choose any service account available in the namespace.
- What could happen
- A workload could run under a highly privileged, potentially cluster-admin, service account.
- How it was fixed
- Restrict service-account selection and apply least privilege at workload admission.
- Status
- PATCHED · 3.16.0
CVE-2026-40893 ExifTool dangerous-tag blocklist bypass High · 8.2
group-prefixed metadata→blocklist mismatch→dangerous tag accepted
- What was assumed
- Blocklisted tag names would always arrive in one canonical form.
- What could happen
- An attacker could influence file rename and move behavior during document processing.
- How it was fixed
- Normalize and validate group-prefixed tag names before evaluating the dangerous-tag policy.
- Status
- PATCHED · 8.31.0
CVE-2026-23603 Blind SSRF through OAuth2 avatar synchronization Low · 3.1
OIDC picture claim→server-side fetch→internal destination
- What was assumed
- The identity provider's picture claim was safe to fetch from the server network.
- What could happen
- A low-privileged user could trigger blind requests to otherwise unreachable internal URLs.
- How it was fixed
- Validate remote avatar destinations and constrain outbound fetch behavior.
- Status
- PATCHED · 1.27.0
How I got here
2021
Started studying computer science
Computer science and engineering at CHARUSAT.
2023
Published a research paper
Wild animal detection using YOLOv8, in Procedia Computer Science.
2024
Started testing real products
Web, mobile and API security testing at Inventyv.
2026
Reported my first vulnerabilities
Three bugs in open-source projects, all fixed by the maintainers.
Now
Turning findings into checks
Writing rules and defaults so the same bugs cannot come back.
Next
Going deeper on infrastructure
Cloud, Kubernetes and supply-chain security.