> PRODUCT SECURITY ENGINEER · Application Security · Offensive Security · Bug Bounty Hunter
I break enterprise apps before attackers do — auditing web, API and Android surfaces, chaining logic flaws into critical impact, and automating the boring parts of the SDLC.
Application / Product Security Engineer with 1+ years of hands-on VAPT across web apps, REST APIs and Android — 50+ enterprise apps assessed and 150+ vulnerabilities validated. Skilled in manual testing of authentication, authorization (BOLA/IDOR), business logic and secure configuration, with working exposure to OWASP Top 10, OWASP API Top 10, OAuth2 / OIDC and JWT / session security.
I run mobile security testing with Frida and MobSF, drive External Attack Surface Management, and build Python + Power Automate pipelines that streamline security testing and threat-intelligence workflows. I partner with engineering to validate remediation and push secure-by-design outcomes across the SDLC.
Active bug bounty researcher on HackerOne & Bugcrowd since 2021, with a track record of responsible disclosure across enterprise programs.
Ship a threat model before the sprint, not after the incident. Every finding gets a re-test until the class of bug is dead.
Automated tools handle the noise. Business logic, authz chains and auth flows still need human intuition — that’s where I live.
Python + Power Automate turn CVE feeds, IOCs and re-tests into signal — so humans focus on the interesting bugs.
Six domains, one operator. Manual depth first — automation to make it repeatable.
Selected offensive, blue-team and product-security work — problem, solution and outcome.
The full brief — preview inline, download the PDF, or hit print.
A year deep in Application Security, I've built my career around finding real risk in web apps, REST APIs and Android surfaces — and shipping fixes with the engineering teams that own them.
“The Product Security role extends beyond traditional penetration testing. The emphasis on secure design, API security, mobile security, automation and integrating security throughout the SDLCclosely matches both my current experience and the direction I want to grow professionally.”
Alongside manual testing, I build Python utilities and Power Automate workflows that streamline threat intelligence, vulnerability management and API testing — and I run continuous EASM to catch exposure before it becomes an incident.
Live feed from bharath.medium.com — research, write-ups and notes.
Recruiting, security partnerships or a quick question — the fastest way in.