this site has two modes.

BUILD, the engineer who trains models.
BREAK, the one who attacks them.

flip the switch ↑ and everything re-frames.

// 02

What I've actually done. Stuff I've broken, legally.

I try not to use adjectives here. Where I can, each line comes with the thing that backs it up: a number, a report, a fix that shipped. Same jobs, different half of the story: the assessments, the findings, the one bug in production that a real company had to patch.

Jun 2026 – present
Remote

Technology Apprentice · SEED ● current

DBS Tech India

  • Got picked for DBS's flagship SEED apprenticeship out of a national pool. Still a bit surreal.
  • Day to day I work on digital transformation and infrastructure resilience inside an actual global bank. Systems where downtime means headlines.
flagship national apprenticeship · global bank
Mar 2026 – Jun 2026
Remote

AI/ML Research Intern ● current

SwiftSafe · cybersecurity AI startup

  • Owned one AI system end-to-end: a 567M-parameter Mixture-of-Experts transformer, trained from scratch. My architecture, my technical calls, empty repo to a 30,000-step training run. PyTorch, DeepSpeed ZeRO-2, 16 experts with top-2 routing, GQA, RoPE, a custom tokenizer.
  • Served it with FastAPI on A100 infrastructure and built the adversarial eval pipelines that beat it up continuously.
  • Wrote the whole journey up on X and LinkedIn as it happened, the wins and the crashes. The training thread crossed 7,800 impressions.
param_count = 567,068,416 · exact, not estimated
Sep 2024 – Aug 2026
KIIT, Bhubaneswar

Lab Coordinator

IoT Lab, KIIT

  • Kept a 30+ member lab running for two years: demos, showcases, onboarding new recruits.
  • Organized a couple of CTFs and mentored juniors who reminded me of me two years earlier. Handed it over in August 2026. The juniors run it now, which was the whole point.
30+ members · 2+ CTFs organized · tenure complete
Dec 2024 – Jan 2025
Remote

Cyber Security & AI/ML Intern

The Red Users

  • Threat analysis and traffic monitoring with Wireshark; built layered defenses against the usual suspects, SQLi and XSS.
May 2024 – Jul 2024
Delhi

Security Testing Intern

Panacea Infosec Pvt Ltd

  • My first real security job, second year of college. Ran 20+ vulnerability assessments and pentests on live client applications.
  • Learned the unglamorous half of security: writing 10+ risk reports that a business person could actually act on. That skill has paid rent ever since.
20+ VAPTs · 10+ risk reports · CVSS-mapped
2024 – present
Remote

Independent Security Researcher

Bug bounty / vulnerability research

  • Found a reflected XSS in Yatra.com's Diya AI chatbot, a real bug on a platform millions use. Reported it quietly, they acknowledged it, fixed it. That's the whole job done right.
  • Ongoing hunting across HackerOne and Bugcrowd programs: XSS, IDOR, SSRF, SQLi.
production disclosure: reported → acknowledged → remediated

// 02.5 · the disclosure

The one I'm
quietly proud of.

I found a reflected XSS in the AI chatbot of Yatra.com, a travel platform millions of people use. I reported it quietly, their security team confirmed it, and they fixed it. No drama, no clout-chasing thread. Just the job done right.

AI features widen the attack surface. I learned that by exploiting one, not by reading about it. It's also why Argus exists: the bug class I found by hand is the one my tool now catches before deployment.

cat disclosures/yatra-diya-xss.md

# Reflected XSS · Yatra.com “Diya” AI chatbot

class: reflected XSS · surface: AI chatbot input path

[1/4] discovered · reflected XSS in the Diya chatbot input path

[2/4] reported · responsible disclosure to the Yatra security team

[3/4] acknowledged · triaged and confirmed by the vendor

[4/4] remediated · fix deployed to production

status: closed ✓ · vendor-acknowledged

← previous chapter · 01

The honest versionThe guy on the other side

next chapter · 03 →

The systemsThe arsenal