// security_engineer.init()

vidhan@intelliroot:~
view findings get in touch
0 client products assessed
0 vulnerabilities disclosed
0 industry experience

01 about

Breaking things professionally, so attackers don't have to.

I'm a Junior Security Engineer at Intelliroot Technologies, with 1.8+ years across web, API, mobile, and network penetration testing, secure code review, and Secure SDLC / Shift-Left implementation. I've run end-to-end assessments on 70+ client products, uncovering business logic flaws and reducing deployment risk before release — not just checkbox findings.

Outside client engagements, I hunt for vulnerabilities independently — public disclosures across Max Healthcare, Deutsche Telekom, Stanford University, and Tata Motors, including an OTP bypass and prompt injection issues in AI-integrated applications. I hold the CEH v13 and CNSP certifications, and I'm actively building toward Application / Product Security Engineering.

baseBangalore, India
roleJunior Security Engineer
focusAppSec · Threat Modeling · DevSecOps
educationB.E. Computer Science, 2024
statusopen to opportunities

02 experience

Assessment history

Junior Security Engineer

Feb 2025 — Present

Intelliroot Technologies (OPC) Pvt. Ltd.

  • Executed end-to-end security assessments (Web, API, Mobile, Network) for 70+ client products, uncovering critical business logic flaws and reducing deployment risk.
  • Conducted Source Code Reviews, SAST, and SCA to identify insecure coding practices and vulnerable third-party dependencies.
  • Collaborated with development teams on Secure SDLC and Shift-Left Security, identifying and remediating issues during early stages of the SDLC.
  • Tested authentication, authorization, and session management controls against OWASP Top 10 — building PoC exploits to demonstrate real-world business impact.
  • Operated Burp Suite, Nmap, Nessus, Metasploit, MobSF, Frida, and Wireshark to execute assessments and validate findings.
  • Prepared detailed VAPT and CERT-In compliant reports covering risk assessment, business impact analysis, and remediation guidance for stakeholder communication.

Cybersecurity Intern

Sep 2023 — Oct 2023

SenseLearner Technologies Pvt. Ltd.

  • Applied classroom theory to live cybersecurity assessments, focused on incident response and penetration testing.
  • Ran vulnerability assessments using Nmap and Burp Suite.

03 projects

Security tooling I've built

SAST PRJ-01

SecureFlow

AI-Assisted Static Application Security Testing Platform

  • Developed and deployed a multi-language SAST platform for Python, JavaScript/TypeScript, PHP, Java, and Go using AST-based, interprocedural, and cross-file taint analysis.
  • Detects SQL Injection, XSS, Command Injection, SSTI, SSRF, Path Traversal, XXE, NoSQL Injection, unsafe deserialization, JWT weaknesses, and hardcoded secrets, with source-to-sink tracing and confidence-aware findings.
  • Built coverage visibility, suppression workflows, technical/executive PDF reports, authentication, password recovery, and project/scan management, and deployed using Render, Supabase PostgreSQL, and Brevo API.
PythonJavaScript/TypeScriptPHP JavaGoSASTAST Taint AnalysisRender Supabase PostgreSQLBrevo API
Live Application ↗

04 skills

Tooling & capability

Languages

PythonJavaScript

Application Security

Secure SDLCShift-Left Security Threat Modeling (STRIDE)Secure Code Review Static Application Security Testing (SAST)Dynamic Application Security Testing (DAST) Software Composition Analysis (SCA) OWASP Top 10OWASP API Top 10

DevSecOps / CI-CD

CI/CD Security PipelineSemgrep (Custom Rules)

Offensive Tooling

Burp SuiteNmapNessusNuclei MetasploitSQLMapWireshark

Mobile & Reverse Engineering

MobSFFridaJadxApktool

Vulnerability Classification

CVSSCWERisk Assessment CERT-In Compliant Reporting

Networking & Systems

HTTP/HTTPSDNSFTPSSH TCP/IPUDPKali Linux Linux Fundamentals
Web Application Pentesting
API Security Testing
Network Penetration Testing
Source Code Review / SAST / SCA
Mobile Application Security
Threat Modeling (STRIDE)
DevSecOps / CI-CD Security

05 findings

Independent bug bounty disclosures

A selection of vulnerabilities identified and responsibly disclosed outside of client engagements.

CRITICAL FND-01

OTP Bypass in Authentication Workflow

Target: Max Healthcare

Identified a logic flaw in the OTP verification flow allowing authentication bypass, exposing user accounts to unauthorized access.

disclosed
HIGH FND-02

Config Disclosure, HTML Injection & Session Flaws

Target: Deutsche Telekom

Identified sensitive configuration disclosure alongside HTML injection and session-management vulnerabilities across the application.

disclosed
MEDIUM FND-03

Information Disclosure (x2)

Target: Stanford University

Reported two separate information disclosure issues exposing internal application details to external parties.

disclosed
MEDIUM FND-04

Information Disclosure (x3) + Misconfiguration

Target: Tata Motors

Identified three information disclosure issues and one security misconfiguration across exposed endpoints.

disclosed
AI SECURITY FND-05

Prompt Injection in AI-Integrated Applications

Target: Client Engagements (Confidential)

Identified prompt injection vulnerabilities in LLM-integrated client applications, demonstrating how untrusted input could override intended model behavior.

disclosed

06 achievements

Recognition & badges

Badges

Essential, Web Fundamentals, HTTP, API Badges

PentesterLab

07 certifications

Credentials & education

CEH v13

Certified Ethical Hacker (v13)

EC-Council

CNSP

Certified Network Security Practitioner

The SecOps Group

Bachelor of Engineering, Computer Science

Prof. Ram Meghe Institute of Technology & Research, Badnera

2020 — 2024
CGPA: 7.81 · 74.19%

08 contact

Let's connect

Open to Product Security, AppSec, and DevSecOps opportunities. Reach out directly.

email vidhanthakur17@gmail.com phone +91 7058485637 linkedin /in/vidhan-thakur github /VidhanThakur17