Independent application security · CRTP · CWES
I test authorization, authentication, tenant boundaries, APIs and business logic — then turn the findings into reproducible evidence your engineering team can act on.
Selected work
Examples from authorized assessments and responsible disclosure. Sensitive implementation details are omitted where they are not public.
Authentication · responsible disclosure
A weakness in the authentication flow made it possible to access another user account without possessing that user’s valid credentials.
Impact: account takeover · privately disclosed
Data exposure · responsible disclosure
A data-exposure issue allowed sensitive personally identifiable information associated with credit-card customers to be retrieved outside the intended access boundary.
Impact: customer PII exposure · privately disclosed
Incorrect authorization · public advisory
A lower-privileged authenticated account could change a super administrator’s password or elevate privileges to administrative control.
CVSS 3.1: 8.8 High · NVD ↗ · Vendor advisory ↗
Authorized VAPT · access control
An authenticated user could perform user operations across customer tenants, breaking a core isolation boundary in a multi-tenant security product.
Impact: cross-tenant account operations · client identity confidential
Additional research acknowledged or rewarded by Red Hat, Blinkit, Utho, Survicate and MSG91.
Direct engagement
Security Engineer / Penetration Tester at BugBase, working across web and API assessments, exploitability analysis, vulnerability triage and remediation validation.
I scope the engagement, perform the testing, write the report and retest the fixes myself. There is no account-manager-to-tester handoff.
Direct access and lower overhead keep pricing lean without reducing testing depth.
VAPT pricing
For a focused web + API product, most engagements fall in the range shown. Larger or multi-application scopes are quoted after review.
Authentication, sessions, authorization, tenant isolation, APIs, business logic, high-risk workflows and relevant OWASP-class vulnerabilities.
Prioritized technical report, reproducible evidence, severity and business impact, remediation guidance, findings readout and one remediation retest.
User roles, API surface, authentication model, workflow complexity and integrations. Targeted source-code review can be added when it materially improves coverage.
Next step
Send the application type, user roles, API scope and preferred testing window. I’ll confirm the scope, timeline and price before testing begins.
jalajkumar1011@gmail.com ↗