Vikas G.

**Penetration Tester | Application Security Engineer | AI Security Researcher** **700+ Validated Vulnerabilities | CVE Researcher | Web, API & AI Security** I help startups, SaaS companies, and established businesses identify critical security vulnerabilities before attackers exploit them. I'm an experienced **Application Security Engineer, Penetration Tester, and Security Researcher** with 5+ years of experience in offensive security, vulnerability research, and software development. My work includes discovering **700+ validated security vulnerabilities**, identifying high-impact issues across real-world applications, and receiving recognition for vulnerability research, including **CVE-2023-3479**. I specialize in finding vulnerabilities that automated scanners often miss — complex business logic flaws, broken access controls, authentication bypasses, and vulnerabilities that can be chained together to create significant security risks. ### 🔐 My Core Services **Web Application Penetration Testing** - OWASP Top 10 security assessments - Authentication and authorization bypasses - Business logic vulnerabilities - SQL injection, XSS, SSRF, SSTI, and other injection flaws - Session management and access control testing **API Security Testing** - REST API penetration testing - Broken Object Level Authorization (BOLA/IDOR) - Broken Function Level Authorization (BFLA) - Mass assignment and privilege escalation - JWT, OAuth, and authentication security - Sensitive data exposure and API misconfigurations **AI & LLM Application Security** - AI chatbot and LLM application security assessments - Prompt injection and insecure output handling - Sensitive information disclosure - AI-powered application and API security - OWASP Top 10 for LLM Applications **Vulnerability Research & Advanced Security Testing** - Manual vulnerability discovery and exploitation - Vulnerability chaining and attack-path analysis - Cloud and infrastructure exposure assessments - Custom security tooling and automation - Attack surface discovery and reconnaissance ### 🛠️ Tools & Technologies **Security:** Burp Suite, OWASP ZAP, Nuclei, Nmap, SQLmap, FFUF, and custom security tools **Programming:** Python, JavaScript/TypeScript, Go, PHP, Bash, SQL **Platforms:** Linux, Docker, cloud infrastructure, web applications, and APIs ### 📋 What You'll Receive - Thorough manual security testing backed by targeted automation - Clear, reproducible proof-of-concept demonstrations - Risk-based vulnerability reports with practical severity assessments - Developer-friendly remediation recommendations - Retesting and validation of security fixes when included in the engagement - Direct communication throughout the assessment ### ⭐ Why Work With Me? **Real vulnerability research experience.** My work goes beyond running automated scanners. I investigate how applications actually behave and uncover security weaknesses that require creativity and technical depth. **A developer's perspective.** My software engineering background helps me understand application architecture, identify root causes, and recommend practical fixes. **Long-term client relationships.** I've built trusted relationships through consistent security work, clear communication, and reliable delivery. **Quality over quantity.** I focus on meaningful, exploitable security risks rather than overwhelming clients with low-value findings. ### 🚀 Let's Secure Your Application Whether you need a one-time penetration test, an independent security assessment, or ongoing application security support, I can help you identify and address the risks that matter most. **Send me a message with your application, scope, and security goals. I'll help you determine the right testing approach.**