No posts.
A 27-year-old Bug Bounty Hunter and Web Security Researcher. I specialize in identifying and responsibly disclosing security vulnerabilities in web applications. My work focuses on OWASP Top 10 vulnerabilities including XSS, SQLi, IDOR, SSRF and Authentication Bypass.
Passionate about breaking things the right way - and reporting them before the wrong people do.
Hi, I'm Saurabh Kushwaha - a Bug Bounty Hunter and Web Security Researcher focused on real-world, impact-driven findings. I hunt for logic flaws, broken access control and injection issues across modern web stacks, then work with vendors through responsible disclosure so the fix ships before anything goes public.
Official appreciation for responsibly reporting a security vulnerability.
Received a Letter of Appreciation from NASA under their Vulnerability Disclosure Program (VDP) for responsibly reporting a security vulnerability. The finding was validated by the NASA security team and handled through their official disclosure channel.
PROGRAM: NASA VDP · STATUS: ACKNOWLEDGEDRecon → enumerate attack surface → map trust boundaries → test for logic and race conditions → chain low-severity issues into real impact → write a clear, reproducible report. No destructive testing, no data exfiltration - only proof.
Core services and security disciplines I practise every day.
End-to-end web app assessments: reconnaissance, exploitation, privilege analysis and risk-rated reporting.
Long-haul hunting on public and private programs with clean, reproducible reports and vendor coordination.
Passive and active asset discovery, fingerprinting, hidden endpoint mining and attack-surface mapping.
REST/auth fuzzing, IDOR and BOLA checks, mass assignment, rate-limit and object-level authorization flaws.
The languages I script in and the toolkit I run daily.
Disclosure write-ups, methodology notes and recon tricks. Publish a post and it shows up here.
Vulnerability reports, collaboration, or just to say hi - my inbox is open. PGP-friendly and disclosure-first.