I build systems that are hard to break — and break the ones that aren't.
3rd-year B.Tech Computer Science (Cybersecurity), Manipal University Jaipur — open to internship & research opportunities
I'm a third-year Computer Science (Cybersecurity) student who spends most of my time at the seam between building systems and taking them apart. My work leans toward applied cryptography and secure systems design — writing the crypto layer as carefully as I'd audit someone else's. Outside of coursework, I look for real vulnerabilities and report them the boring, responsible way: privately, with a fix in hand before anything goes public.
♟ Also a competitive chess player — the pattern-matching carries over more than you'd think.
A JNI backend bridging Flutter/Dart to the Java Cryptography Architecture — AES (CBC/GCM/CTR), RSA (PKCS1/OAEP) and ECDH, with careful JNI reference and memory handling. Benchmarked from 200ms cold-start down to 1–4ms steady-state.
A real-time messaging backend in C++ with AES-CBC encrypted payloads over WebSockets and JWT-based session authentication and access control, built on Crypto++.
A two-party clean room on Atsign whose keys are destroyed once both stakeholders confirm — access becomes unrecoverable, not just unused. Isolation is structural (agents never call get/lookup), with salted-hash PSI over identifiers.
An autonomous agent that decides, twice a trading day, how to split a max-loss risk budget across three defined-risk QQQ options strategies. One model proposes, a second challenges, and hard risk gates in code get the final say — any failure holds the last valid allocation.
Findings reported privately to maintainers under coordinated disclosure. Listed as evidence of process, not a scoreboard.
Identified and responsibly reported a denial-of-service vulnerability in python-multipart, the multipart form parser used across the Python web ecosystem. Credited in GitHub Security Advisory GHSA-mj87-hwqh-73pj.
View advisoryReported missing-authorization flaws in OpenEMR, the open-source health records platform — including a FHIR QuestionnaireResponse endpoint that let any low-privilege user read every patient's responses, and a document action that let a Documents user email any patient's file to an arbitrary address. Credited as a finder on GHSA-fmmr-p679-97fq, GHSA-6g45-38wc-5wg9 and GHSA-92rh-g949-4mvv.
OpenEMR advisoriesAn authenticated boolean-blind SQL injection in Frappe's query layer: the order_by / group_by denylist in frappe.client.get_list could be bypassed with IF() and REGEXP. Disclosed privately to the Frappe Security Team under coordinated disclosure.