My journey into cybersecurity started with a simple curiosity — what happens when you push software beyond what it was designed to do? That question led me from hunting bugs on public platforms to securing some of the world's largest products at scale. With a Bachelor's in Computer Applications from The Heritage Academy (CGPA: 9.08) and a Master's in Computer Science from BITS Pilani, I built a strong academic foundation — but the real education came from breaking things.
I cut my teeth in the bug bounty world early on, earning Hall of Fame recognitions from Atlassian, Trello, OpenAI, Butler, and SurveyMonkey. That offensive mindset became the backbone of everything I do. I spent nearly 4 years at SAP Labs as a Product Security Engineer, where I performed penetration testing and threat modeling across 15 enterprise applications, managed 16+ customer pentest reviews end-to-end, and automated open-source security scanning workflows that reduced manual effort by 80%. I also built custom security tools from scratch — an API Fuzzer for AI-based services, a log scanner for sensitive data leaks, and a ZAP-based DAST tool tailored for SAP's UI5 framework.
In August 2025, I joined Meta's Product Security team (Family of Apps) in London — and that's where everything leveled up. I saw an opportunity to multiply security impact through AI, and I ran with it. In under 9 months, I've built 4 AI-powered security agents that automate XSS detection, security design reviews, ACL risk assessment, and feature launch monitoring. One of those agents — Sever-Agent — secured 819,000 insecure ACLs in just 9 hours. I've shipped 50+ diffs, triaged 250+ vulnerabilities across 3 oncall rotations (including XSS via Google-served docs, SQL injections, and RCEs), and authored 90+ security commits.
Today, my work sits at the intersection of offensive security, AI/ML, and security engineering at scale. I believe the future of application security isn't just finding bugs — it's building intelligent systems that find, fix, and prevent them autonomously. Whether it's designing multi-agent architectures, writing AQF rules for production, or deep-diving into payment credential flows, I bring a hacker's mindset to every line of code I review and every system I defend.
AI-powered security agents I designed and built at Meta — automating vulnerability detection, security reviews, and access control at billion-user scale.
Built a multi-tier Confucius agent specifically targeting ServerHTML and dangerouslySetInnerHTML sinks across Meta's React/JS codebase. Started with a 2-agent architecture (Main Agent + Hop Analyzer) and iterated it into a full 5-tier fan-out system with specialized subagents:
Follow-up: Added batch-mode fast-path with streaming results and crash recovery. Also ported the entire agent as a Claude Code plugin with 4 skills for the prodsec-review pipeline. Built an XSS remediation skill that generates prioritized code fixes (P0–P5) with BEFORE/AFTER diffs.
Designed and built an automated ACL risk assessment agent that scans and secures insecure access controls across Meta's entire infrastructure. The agent systematically evaluates whether Keychain secret ACLs should be restricted or remain open, using a Security Triager Agent pattern.
Follow-up: Developed AQF (Automated Quality Framework) rules for automated ACL security checks at production across 5+ asset categories. Created rules to flag high-SIR TIER ACLs with overly permissive “open to ALL” access entries.
Built a multi-agent AI system to automate the triage and analysis of MFT (Money Flow Transfer) security consult requests. The agent processes Office Hours documents, evaluates them against Paysec/PCI DSS frameworks, and generates structured risk assessments with severity ratings.
Follow-up: Used the agent to process real MFT consults including Crypto Projects security reviews, FI FinNet assessments, and Billing ML Feature Table privacy evaluations.
Built an AI-powered security crawler that continuously monitors Workplace groups for security-relevant feature launches and risks. The system automatically analyzes posts, crawls linked Google Docs and wiki pages, and generates security risk assessments routed to the Perpetrator event system.
Follow-up: Generalized the crawler into a full Security Design Review Agent (V0.1) supporting multiple input surfaces with risk scoring and structured analysis output.
Vulnerability research at Meta and custom security tooling built during 4 years at SAP Labs — from payment credential reviews to purpose-built DAST scanners.
Led a comprehensive security review of Meta's Money Flow Transfer credential systems. Identified critical transitive access issues in ACLs that could enable unauthorized money transfers. Reviewed Card Network Tokenization flows, NFC Payments (Malibu), Pay-with-X Shopify link account linking, and ASA Support Agent payment/financial agentic tools.
Served on 3 Prodsec oncall rotations at Meta, triaging a broad range of security issues at scale. Discoveries included XSS via Google-served documents, SQL injection vulnerabilities, and Remote Code Execution (RCE) vectors. Published oncall shift summaries and drove remediation across multiple product teams.
Developed a custom fuzzing tool designed to test AI-based APIs at SAP. Supported multiple payload types including image uploads, CSV injection, and NLP-based payloads to test model endpoints for input validation flaws, injection attacks, and unexpected behavior under adversarial inputs.
Built an automation utility that scans application log files to identify sensitive data leaks — PII, credentials, tokens, API keys, and other secrets accidentally logged by developers. Reduced the risk of data exposure through log aggregation systems and helped enforce secure logging practices across SAP products.
Created a custom web vulnerability scanner built on top of OWASP ZAP, specifically tailored for SAP's Fiori/SAPUI5 framework and OData services. Addressed the unique challenges of scanning single-page applications with OData backends. Migrated the build system from Maven to Gradle for improved CI/CD integration.
Automated open-source dependency scanning workflows at SAP using MEND, Blackduck, Trivy, and Grype. Built custom PowerShell scripts integrated with Bamboo CI/CD pipelines and Docker containers to continuously scan for vulnerable dependencies, license violations, and supply chain risks across SAP's product portfolio.
Industry Standard Certification
Altered Security Certified
Bug Bounty Recognition
Bug Bounty Recognition
Bug Bounty Recognition
Bug Bounty Recognition
Bug Bounty Recognition
Monthly contribution heatmap (Aug 2025 — Apr 2026)