From curious tinkering
to breaking real systems.
I'm Harshdeep Athawale, a security researcher/engineer who builds software and breaks it. 35+ vulnerability reports across Red Bull, Goldman Sachs, Adobe, Netflix, NVIDIA, Anduril, Flipkart, and Coca-Cola - and the defenses I build come straight from what breaking them taught me. I care about the full picture: clear reproduction, real impact, and remediation that holds.
The best security work is reproducible, honestly scoped, and written so the defender can fix it the same day.
Location
Pune, India
Education
3rd year CS · TIET
Status
Open to internships · Summer 2027
Focus
AppSec · Bug Bounty · API Security
How it started
It started with a simple question that wouldn't leave me alone: how does software actually break? I'd pull apart apps just to see what assumptions they made - and which ones I could violate. That curiosity pulled me straight into security.
At TIET, coursework was only half the story. The other half was late nights on TryHackMe labs, reading disclosed reports, and learning to think like an attacker. The grind compounded - 230+ labs and a 300+ day streak into the Top 1% worldwide.
Bug bounty changed everything. Hunting real programs on HackerOne and Intigriti - Red Bull, Netflix, Adobe, NVIDIA, Anduril, Flipkart, Coca-Cola - taught me that finding a bug is the easy part. Proving impact, writing a report a stranger can reproduce, and scoring it honestly is the craft.
Then I flipped it. Finding the bugs is what taught me to build the defenses - a transformer-based WAF, plus runtime isolation and API rate limiting for an agentic AI platform at Iris Intelligence. Along the way I won 1st place at Nio Hack (Niograph Inc. & American Society for Engineers, USA - 120+ teams) and placed 1st runner-up at the PSB Hackathon Series 2026 (Govt. of India, 226 teams), and I'm still learning fast by breaking things and writing it up.
Selected findings
Red Bull
CVSS 9.1Critical GraphQL flaw exposing employee PII.
Netflix
CVSS 8.6Auth bypass on the Law Enforcement Portal - government emails auto-approved without review, and consumer domains could register too.
Coca-Cola
Unauth APIUnauthenticated API leaking PII for 892 employees, with write access to a production database.
NHS · Superdrug
Secrets · IDORHardcoded OAuth secrets exposing medical data, and an appointment IDOR - both caught before patient data could be breached.
Anduril · NVIDIA
TakeoverA subdomain takeover, and dangling DNS records silently serving gambling content to real users.
Flipkart · Myntra
RCERemote code execution in a build pipeline, and exposed source maps leaking OAuth secrets.
What I've built
Transformer-based WAF
Catches 96% of real-world attack payloads across 10 attack classes - versus 46% for ModSecurity with OWASP CRS v4.
Agentic AI platform security
Sandboxed untrusted code execution and runtime isolation that stopped cross-tenant leakage at 5,000+ concurrent users.
API abuse controls
Request rate limiting and abuse controls that kept a production AI platform's APIs abuse-resistant under load.
How I work
Impact over noise
A finding only matters if it has real, demonstrable impact. I prove exploitability before I ever write the word 'critical'.
Reproducible or it didn't happen
Every report ships with clear steps, a working PoC, and a CVSS score the triager can verify in minutes.
Map the whole chain
Single bugs are fine; chains are where it gets interesting. IDOR to ATO, source-map leak to OAuth theft, dep-confusion to RCE.
Stay ethical
Scope is sacred. I only test what I'm authorized to, and I report to defenders before anyone else.
Beyond the bugs
Outside of hunting, you'll find me grinding CTFs and labs, reading disclosed reports, and reverse-engineering apps just to understand how they tick. I like learning in public and sharing what actually worked.
I'm drawn to engineers who combine deep technical depth with clear communication - because in security, the report is the product.