My story
Before security was
a career, it was
curiosity.
I was a computer science student more interested in how systems break than what textbooks said. In 2016, before I even graduated, I sent my first security report to SitiBroadband - a vulnerability giving unlimited free broadband access. No bounty, no reward. Just the right thing to do.
In 2018, I discovered an unsecured database belonging to mSpy exposing over 2 million customer records - passwords, iCloud tokens, private messages. I contacted Brian Krebs. The story ran in KrebsOnSecurity and TechCrunch the same day. Database taken offline within hours.
That is the work. Finding things genuinely exposed - Kibana instances, unsealed Consul clusters, open Jenkins pipelines - and getting them fixed before someone with worse intentions does.
Timeline
2016
First responsible disclosure
SitiBroadband vulnerability giving unlimited free broadband. No reward - just the right thing to do.
2017
Graduated computer science
Already two years into security research. Turned it into a full-time focus.
2018
mSpy disclosure + TechCrunch coverage
First bounty from Redbus in January. Then mSpy's 2M+ record database - covered by TechCrunch & KrebsOnSecurity.
Now
500+ disclosures, CEH V13
Available for freelance engagements, responsible disclosure, and full-time roles.