Security researcher / India

Assume nothing.Trust no input.

I research vulnerabilities in mobile apps, web applications, cloud services, and smart contracts. This site is where I publish the work.

Read my research See my CVEs

Android securityiOS securityWeb applicationsSmart contractsCVE researchCloud Android securityiOS securityWeb applicationsSmart contractsCVE researchCloud

Recent write-ups

Bugs I found and how they worked.

$Dithered cobalt poster of an investigator approaching a fractured glass portal$ Published

01 / AndroidJan 2025

Mobile application security

When WebView bites back

An exported Android activity loaded attacker-controlled content in a WebView and allowed JavaScript execution.

Vector: Exported activity
Outcome: JavaScript execution

Read the write-up

Dithered cobalt poster of an ancient mint producing an endless stream of blank coins

Published

02 / Web3Mar 2025

Smart contract security

The function that could mint forever

A missing authorization check allowed the contract to mint tokens without a supply limit.

Vector: Missing authorization
Outcome: Unlimited minting

Read the write-up

Dithered cobalt poster of a courier facing three diverging routes

Published

03 / MobileDec 2024

Identity and deep links

How a news app leaked OAuth codes

A conflicting Android deep link let another app receive an OAuth authorization code.

Vector: Deep-link collision
Outcome: Code interception

Read the write-up

Dithered cobalt poster of a hidden breach beneath a monumental archive

Published

04 / WebNov 2023

Web application security

SQLi: finding to exploitation

How I confirmed a SQL injection, demonstrated database impact, and reported it responsibly.

Vector: Unsafe input
Outcome: Database access

Read the write-up

Assigned vulnerabilities

Assigned CVEs.

CVE-2025-66513Research record

NextcloudSecurity advisoryPublished 02

CVE-2025-66515Research record

NextcloudSecurity advisoryPublished 03

CVE-2026-21309Research record

AdobePublic advisoryPublished 04

CVE-2026-34647Research record

Adobe CommerceAPSB26-49Published 05

CVE-2026-45159Research record

NextcloudSecurity advisoryPublished 06

CVE-2026-45280Research record

NextcloudSecurity advisoryPublished 07

CVE-2026-45283Research record

NextcloudSecurity advisoryPublished 08

CVE-2026-47996Research record

Adobe CommerceAPSB26-73Published 09

CVE-2026-47984Research record

Adobe CommerceAPSB26-73Published 10

CVE-2026-71362Research record

Adobe CommerceAPSB26-92Published 11

CVE-2026-47922Research record

Adobe Content CredentialsAPSB26-111Published

Security acknowledgements

Hall of fame and thanks received.

25+

Organizations

Organizations that acknowledged or credited my vulnerability reports.

GoogleTechnology

MicrosoftTechnology

AppleTechnology

MetaTechnology

AWS

Amazon / AWSCloud

AdobeCreative technology

NextcloudOpen-source cloud

IntelHardware

GitHubDeveloper platform

CoinbaseFinancial technology

PayPalPayments

SalesforceEnterprise cloud

PhilipsHealth technology

NCIIPCGovernment

UK GovernmentGovernment

Dutch GovernmentGovernment

VismaEnterprise software

LenskartRetail technology

ReckittConsumer health

Baloise InternationalInsurance

RobecoAsset management

RechtspraakJudiciary

ResMedMedical technology

Bloom & WildCommerce

EvriLogistics

Books and notes

What I’m reading.

Selected books / 05

Five books I keep returning to, and the idea each one left behind.

Featured volume

Literature / Human nature

The Brothers Karamazov

My notes on faith, doubt, responsibility, and how people justify their choices.

My noteSimple moral answers rarely survive a closer look.

View my notes

Knowledge / ProgressThe Beginning of Infinity

Explanations that change what is possible.

Behavior / RiskThe Psychology of Money

Decisions, incentives, and long horizons.

Philosophy / PracticeMeditations

Attention, restraint, and self-command.

Fiction / SocietyGodan

Power, dignity, and the cost of survival.

Have something worth discussing?

Contact me