About
I've reported vulnerabilities to Meta, Microsoft, and the Mumbai Police (through CERT-In), and my backends have handled payments, ticketing, and media for events with thousands of attendees.
I'm studying IT at NMIMS Mumbai (class of 2028) and working as a security engineer intern at R.U.D.R.A Cybersecurity. I take on freelance work — security assessments, penetration testing, and backend or API builds. The fastest way to reach me is contact@jkartik.in.
Security research
On the defensive side: hardened infrastructure protecting 16,000+ users' data, and stopped a ransomware incident with a backup-and-recovery deployment under pressure.
Projects
All projects →Writing
All posts →
When a form becomes infrastructure: maintaining an official railway concession system
Building the MPSTME Railway Concession system was only the beginning. The harder part was making it official, keeping it dependable, and staying responsible for the people and process around it.
Building conc-qr, Social Conclave's check-in system
The system behind Social Conclave's badge scanning with role-based access, a live-editable permission matrix, and a race condition I fixed by accident while chasing latency.
The server can't read this: designing zero-knowledge sharing
How GhostShare shares notes and files in real time while making the server mathematically unable to read them — in-browser key derivation, AES-GCM, and direct-to-R2 encrypted uploads.
A B-Tree on disk: writing a storage engine from scratch
What actually happens between INSERT and the disk — building bad-db's on-disk format, a hand-rolled B-Tree index, tombstones, and compaction in plain Java.
Experience
R.U.D.R.A Cybersecurity
Security engineer intern- Automated attack-surface monitoring with BBOT, cutting ~$20k/yr of manual work.
- Built a custom Semgrep module with findings visualized in Neo4j.
- Found two high-severity vulns (LFI, broken access control) in a banking client's portal via manual code review; automated detection with Nuclei.
- Purple-team exercises with Sliver C2.
ACM MPSTME
Chairperson- Chairperson of ACM MPSTME (since 2026), my college's computing society — leading its technical direction. Head of Technical Department across NMIMS's biggest student bodies in 2025–26: Taqneeq (the tech fest), MUN Society / Mumbai MUN, Social Conclave, and Sattva — where I led the platforms and apps thousands use each year.
- Shipped Delego, the Mumbai MUN delegate app, to the App Store and Play Store — and built the FastAPI backend running it for 600+ delegates.
- Built fest infrastructure at scale: a gamified loyalty/credits backend and a Discord onboarding system that registered 1,100+ hackathon participants.
Also: 1st globally at the chat.win AI Jailbreakathon (LLM attack & defense) · 1st at Taqneeq CodeForge 2026 · Rank 1 in Smart India Hackathon's internal round · open-source contributor (SWFT) · NMIMS Mumbai IT, class of 2028.
Have something to build — or break?
Open to freelance work: security assessments, penetration testing, and backend/API builds.
contact@jkartik.in