Security Researcher & Engineer · Bengaluru
Security research, threat modeling and AI-powered automation. Senior Security Engineer at Cloudflare.
Latest research
A crafted React Flight payload carrying multiple typed arrays could execute code on servers that render
React Server Components, including Next.js apps using use cache. One root cause, two critical advisories.
Coordinated disclosures credited to me, newest first. Select one for details.
One root cause · React Flight deserialization
Specially crafted payloads sent to frameworks that support React Server Components could lead to remote code execution, in cases where a response carries multiple typed arrays alongside an attacker-controlled value.
use cache functions returning typed arrays
Critical9.5
Applications using the App Router with Cache Components could be exploited for remote code
execution when a use cache function returns multiple typed arrays. No workaround
exists. The fix shipped in Next.js 16.4.1.
Applications using the Pages and App routers without Cache Components could allow remote code execution when the server runs on a Windows filesystem. No workaround exists, so affected deployments needed to upgrade.
permessage-deflate memory exhaustion
High7.5
A remote attacker could send crafted WebSocket messages once permessage-deflate is
negotiated, driving unbounded allocation in PerMessageDeflateFunction.largerBuffer()
and causing denial of service. Mitigated by setting maxDecompressedBufferSize.
Intel® Processor Identification Utility before 8.0.43 could allow an authenticated local user to escalate privileges. Disclosed in Intel's November 2025 security advisory.
Tools I've built for security research and automation.
Open source on GitHub Featured
A multi-agent security research harness that independently validates findings. A coordinator dispatches research workers through a durable queue, and a different agent must replay every result before it counts.
Open source on GitHub
The OWASP Top 10 for Agentic Applications (2026) as machine-readable JSON and YAML, with cross-framework mappings for threat modeling and detection.
data/ ├─ owasp_agentic_top10_full.json ├─ owasp_agentic_top10_full.yaml ├─ owasp_agentic_top10_entries.json ASI01 to ASI10 ├─ owasp_agentic_top10_mappings.json └─ owasp_agentic_top10_simplified.json
{ "id": "ASI01", "title": "Agent Goal Hijack", "related_llm_entries": ["LLM01:2025 Prompt Injection", ...], "aivss_core_risk": "Agent Goal & Instruction Manipulation", "mitigations": [...] }
Write-ups, tutorials and incident reports.
Cloudflare Blog Latest
Reused disk blocks in Containers and Sandboxes were not zeroed, so one tenant could read data left by another. The root cause, the fix, and how we confirmed no exploitation.
Hashnode
How pull_request_target can hand repository secrets to an attacker, and the two-workflow pattern that stops it.
Hashnode
A working PoC where a public npm package shadows an internal one, and the registry settings that prevent it.
Hashnode
Coverage-guided fuzzing with LibFuzzer and sanitizers, from a toy C++ program to libxml2.
Workshops and masterclasses.
CySecK · IISc Bengaluru Latest
Session with a live demonstration at the Centre of Excellence for Cybersecurity Karnataka workshop for MSMEs, held for Cybersecurity Awareness Month. Co-presented with Sahil Gupta of Cloudflare.
nasscom · Virtual masterclass
Presented a nasscom masterclass on securing AI applications, infrastructure and data, covering AI security risks, governance and privacy, and how organizations get ready to adopt AI safely.
I'm a security researcher and engineer in Bengaluru, currently a Senior Security Engineer at Cloudflare, and previously at Intel, Dell and HP. I work across the whole life of a vulnerability: finding it, proving its impact, coordinating disclosure, and building the tooling that keeps the same class of bug from coming back.
Source audits and exploit development across web frameworks, server runtimes and desktop software.
AI-powered code review agents, variant analysis and bug bounty agents that find, validate and triage vulnerabilities at scale.
Threat modeling, design review and code review for web applications and APIs.
Multi-agent research harnesses and threat intelligence for agentic systems.
Over 12 years across product security, offensive research and cloud security.
Cloudflare · Bengaluru
Intel Corporation · Bengaluru
Dell EMC · Bengaluru
HP · Bengaluru
Tata Consultancy Services · Hyderabad
Academy of Technology
For coordinated disclosure, research collaboration or speaking.