I find infrastructure
exposures
before attackers do.

I was a computer science student more interested in how systems break than in what textbooks said about them. In 2016, before I even graduated, I sent my first security report to SitiBroadband - a vulnerability that gave unlimited free broadband access. No bounty, no reward. Just the right thing to do.

I graduated in 2017. By that point I had already been doing security research for two years alongside my studies - not because anyone asked me to, but because I could not stop noticing the gaps.

Then on 16 January 2018, I reported a cookie injection vulnerability to Redbus. They paid me a bounty - my first. A real flaw in a product used by millions of people, handled honestly. That moment set the direction for everything that followed.

Since then - over 500 disclosures, more than 300 rewarded, across companies of every size. The work is always the same: find something real, document it properly, report it honestly.