Security research

Awarded a $1,500 bug bounty by Meta for a privilege-escalation vulnerability in WhatsApp, reported through its official disclosure program.

Reported multiple access-control and information-disclosure issues in Microsoft Intune and the Exchange Admin Center to Microsoft's MSRC — including organisation member data served before authorization checks (a time-of-check/time-of-use gap spanning Intune, Entra, and Azure), and standard users bypassing 'restricted' policies to modify directory name fields and join closed groups through the Exchange admin portal.

Found a stored cross-site scripting vulnerability on the official Mumbai Police website and disclosed it responsibly in coordination with CERT-In.

Reported exposed staging infrastructure with the potential for a full compromise.

Reported a source-code and credential leak that opened the door to a potential CRM takeover.

Found a high-severity local file inclusion vulnerability in a banking client's web portal through manual code review during a R.U.D.R.A engagement, then automated detection with Nuclei.

Identified a high-severity broken-access-control vulnerability in the same banking portal, exposing restricted functionality to unauthorized users.

Hardened the server infrastructure of a web platform with 16,000+ users, as freelance work.

Led the incident response when that platform was hit by ransomware: contained it and restored service through rapid backup and recovery.