The smallest detailsexpose the biggestweaknesses.
I investigate application security, uncover vulnerabilities, and help make digital systems more resilient.
The art of finding what others miss.
Web applications, APIs, authorization, and business logic.
The check must connect the actor to the object and the action. Route guards alone cannot answer whether this actor may touch this record.
Access control
Object-level authorization, tenancy, and privilege boundaries.
API security
Surface mapping, trust between services, and enforcement gaps.
Authentication
Identity, sessions, token lifecycle, and account transitions.
Business logic
Sequence, state, and rules that valid requests can still violate.
What systems assume.
Publication policy: client and program details are shared only under coordinated disclosure. The notes above are educational analyses, not confidential report material.
Disclosure approachA record of acknowledgement.
Verified acknowledgements from security programs. Severity is the program’s assessment of the reported issue, not a public award. No report contents are disclosed.
Read the recordBooking.com
Booking.com
DoorDash
Amazon Vulnerability Research Program
Acknowledged by the program. No endorsement or employment is implied.
Method, not magic.
Frame the surface
Start with the system as it is meant to work: actors, objects, data flows, trust boundaries, and the business rules that hold the workflow together. Scope and permission are settled before a request is sent.
Map the assumptions
Identify where the system assumes identity, ownership, sequence, or client trust. The most useful questions are usually about what has been taken for granted rather than what looks unusual.
Test with restraint
Use the smallest safe request that can confirm or reject a hypothesis. Stay inside scope, use controlled accounts and data, avoid destructive payloads, and stop once the evidence is sufficient.
Prove the impact
Separate behavior from consequence. Validate the finding against the intended model, isolate the cause, and document the smallest demonstration that makes the risk legible without exposing more than necessary.
Scope / restraint / evidence / disclosure
Responsible disclosure“The most interesting vulnerabilities rarely begin with a payload. They begin with a question about how a system expects to be used.”
My work concentrates on the application layer: the places where identity, ownership, sequence, and trust are decided. The aim is not novelty. It is evidence.
About the researcherHave a surface
worth examining?
For security research, application security reviews, or a considered conversation about a finding.
anirbanbanerjee3112@gmail.com