I break things to understand how they work — then build them back stronger. Based in Kathmandu 🇳🇵, I focus on offensive security and web application pentesting, with hands-on experience in cloud infrastructure and IoT systems.

• Grinding through PortSwigger Web Security Academy labs (Access Control, Auth, SQLi)
• Building toward bug bounty on HackerOne & Bugcrowd
• Exploring real-world recon workflows and automation

Built a deliberately vulnerable e-commerce app, then pentested it end-to-end.

• Exploited IDOR, broken authentication, missing RBAC, and information disclosure
• Full grey-box pentest documented across all 7 phases of the Cyber Kill Chain
• Node.js SQLite Docker Burp Suite Nmap Gobuster

Cloud-connected IoT security system deployed on AWS EC2.

• ESP32 → MQTT → Python subscriber → InfluxDB → Grafana dashboard → SNS alerts
• Infrastructure provisioned with AWS CloudFormation
• ESP32 Python Docker MQTT InfluxDB Grafana AWS EC2 SNS

Full desktop GUI in Java with OOP architecture and real-time duplicate detection.

• Java Swing OOP File I/O

Security

Dev & Cloud

PortSwigger Web Security Academy  →  Access Control · Business Logic · SQLi
HackerOne                         →  Recon · Subdomain enumeration · Real targets

Always down to collaborate on security research, CTFs, or open source — reach out anytime.