Independent Vulnerability Researcher & Bug Bounty Hunter
Google VRP, HackerOne, Bugcrowd, Cosmos, Private Programs · 2025 – Present
• Responsibly disclosed critical and high-severity vulnerabilities across public and private bug bounty programs; earned bounties from Upstox, BigONE Exchange, and additional private targets.
• Google VRP — Gemini AI Infrastructure (P2, TRIAGED): Identified and reported a vulnerability directly impacting Google's flagship Gemini AI model infrastructure. Report officially reproduced and escalated to Priority 2 by Google Security Engineers. Details withheld under responsible disclosure NDA pending patch deployment.
• Google VRP — Google Cloud Infrastructure (P3, TRIAGED): Discovered a separate security flaw within Google Cloud's production environment — reproduced, assigned, and triaged at Priority 3 by Google Security Team. Full technical write-up to be published post-remediation.
• HackerOne — Cosmos / EVM (Critical, Report #3578035): Identified and submitted a critical-severity vulnerability in Cosmos blockchain infrastructure. Report was triaged as Critical by the security team prior to eligibility review. Vulnerability class and technical details withheld pending program resolution.
• Upstox (Rewarded): Discovered a Remote Code Execution vulnerability on an internal production server — achieved unauthenticated code execution on backend infrastructure; bounty awarded for responsible disclosure.
• BigONE Exchange (BIGONERB-31 & BIGONERB-56, $100 + $105 USD): Identified and reported two resolved configuration vulnerabilities; both validated, patched, and rewarded.
• Airbnb — HackerOne (High 7.0–8.9, #3539985): Auth bypass via unlinked OAuth provider — "Zombie State" flaw allowing silent login via disconnected Google OAuth, bypassing SMS 2FA entirely.
• HealthifyMe — Bugcrowd (P1, CVE-2025-55182, Resolved): Unauthenticated RCE via React Server Components deserialization on gpt-app.healthifyme.com; pre-auth code execution — resolved by vendor.
• Uncovered 0-Click Account Takeover via IDOR in private program; discovered 9,000+ HDFC Bank debug/error pages via advanced dorking; detected live cryptocurrency miners across multiple production websites. Detected Reflected/Stored XSS and security misconfigurations across web and Android applications.
• CERT-In Hall of Fame — Government of India: Recognized for discovering RCE, multiple XSS flaws, and a critical security vulnerability within the official Passport Seva Android application, directly contributing to the security of national digital infrastructure.