Devansh B.

If you're building a B2B SaaS product and haven't had a proper security review, you're carrying risk you can't see. Enterprise clients, investors, and SOC 2 auditors will ask about it and "we haven't done one yet" is the answer that stalls deals and kills closings. I do web application and API pentests for Seed to Series B SaaS companies. Real findings with clear attack paths and developer-friendly fixes. Not a scanner report with your logo on it. Before any engagement, we do a 20-minute scoping call to define exact scope, methodology, and deliverables, so you know precisely what you're getting before a dollar changes hands. What I test: 1. Web application security: Authentication flaws, privilege escalation, IDOR, business logic vulnerabilities, sensitive data exposure 2. API security: BOLA, broken authentication, injection, improper authorization 3. Cloud infrastructure: AWS/Azure/GCP IAM misconfigurations, storage exposure, privilege escalation paths 4. Network security: Internal segmentation, exposed services, firewall misconfigurations 5. CI/CD pipelines: Secrets exposure, pipeline abuse, GitHub Actions and GitLab CI weaknesses 6. Container & Kubernetes: Misconfigured RBAC, exposed dashboards, container escape paths, privilege escalation within clusters 7. Supply chain: Dependency attacks, build pipeline risks, compromised packages, OIDC misconfigurations 8. AI security: LLM prompt injection, data leakage, model misuse scenarios What you get: Every finding comes with a working exploitation path, not theoretical risk. Clear business impact so your engineering team understands why it matters. Developer-friendly remediation guidance they can act on immediately. Optional retesting once fixes are in. Background: I've spent 4 years finding real vulnerabilities at depth. Published 4 CVEs, earned Bugcrowd MVP recognition, and served as HackerOne Pod Lead across 200+ programs including Reddit, eBay, Sony, and Bumble. I've triaged and validated 1,000+ vulnerabilities across web, API, cloud, and mobile. I'm not learning on your project. A note on my work history: I have an early 2022 contract on here that ended badly, I took on a project without the availability to complete it and communicated poorly. That was on me. Since then I scope every engagement upfront with a call before any work begins. It doesn't happen anymore. If you want a quick look at your external surface before committing to anything, message me. I'll take a look and tell you what stands out.