Axis BankResponsible disclosure
Credit-card customers’ personal data was accessible outside the intended controls.
Sensitive customer information could be retrieved beyond the intended access boundary.
ImpactCustomer data exposure
Independent Web + API VAPT
Web & API
penetration testing.
Directly with the tester.
I focus on authorization, authentication, tenant isolation and business logic - the places where product context matters more than scanner coverage.
Research acknowledged or rewarded byRed HatBlinkitUthoSurvicateMSG91
01 / Security work
What the findings meant.
A few examples from client assessments and responsible security research.
Passport Seva PortalGovernment of India
A weakness in account recovery could allow unauthorized account access.
The issue affected a high-value identity account and could expose sensitive account information. It was later fixed.
ImpactAccount compromise risk
CVE-2026-72831Public advisory · 8.8 High
A lower-privilege user could reach full administrative access.
The issue is publicly documented and fixed.
VerifiedPublic CVE
MSG91Paid security research
Multiple accepted findings affected customer data and account protection.
The work covered several independent application-security weaknesses across data handling and account-security controls.
OutcomeMultiple findings accepted
Confidential B2B clientAuthorized VAPT
A tenant-isolation failure crossed a core customer boundary.
The assessment identified an authorization weakness in a multi-tenant security platform.
ImpactTenant isolation failure
02 / Background
Testing, research and engineering.
Professional testing, hands-on research, public work and engineering experience, all feeding into the way I approach each assessment.
20+Web & API assessments
2Published CVEs
4.8 / 5Fiverr · 68 reviews
Professional
Security Engineer / Penetration Tester at BugBase
Web & API assessments, exploitability analysis, vulnerability triage and remediation validation.
Built
TryHackMe · Intigriti · PWNX
Road room, Traveller challenge and 20 Docker-based security labs.
Recognition
1st place · 2nd individual
Great AppSec Hackathon 2026; Ghost in the Ledger at IIT Bombay.
Engineering
Python / Bash automation
Testing helpers, browser workflows, result processing and edge-case reproduction.
03 / VAPT engagement
Scope first.
Quote by email.
Every engagement is quoted after I review the actual application and testing scope. I perform the testing, reporting and remediation retest myself.
Send a detailed scope of work and I’ll reply with the engagement assumptions and a fixed quote.
Scope→Quote→Test→Report→Retest
To request a quote
Email the detailed scope of work.
Include enough detail to size the assessment accurately:
Assets
Applications, domains, environments and what is in or out of scope.
Access
User roles, test accounts and the authentication model.
API surface
Endpoint count or Postman / OpenAPI documentation, plus relevant integrations.
Testing window
Preferred dates, operational constraints and any testing restrictions.
04 / Next step
Send the scope.
I’ll review and quote by email.
Please include the in-scope applications or domains, user roles, API surface, testing constraints and preferred testing window.
jalajkumar1011@gmail.com ↗