What I work on, and the proof.

Web application testing

Cross-site scripting, CSRF, injection and filter bypasses

• Case noteCVE-2021-3258: stored XSS in a Question2Answer plugin
• Write-upBypassing eBay's XSS protection
• Write-upReflected XSS leading to CSRF bypass and account takeover
• Write-upLeveraging SQL injection to execute XSS by evading CSP
• Write-upXSS on samy.pl
• CertificationCertified Ethical Hacker (Master)
• CertificationCertified AppSec Practitioner (Merit)
• ServicePenetration testing
• RoleSenior security researcher, Eminence Ways

API security testing

Including the OWASP API Security Top 10

• CertificationCertified API Security Analyst
• CertificationAPIsec Certified Practitioner
• ServicePenetration testing
• RoleSenior security researcher, Eminence Ways

Cloud security assessments

Identity and access, misconfigurations and attack paths across cloud environments

• CertificationCertified Multi-Cloud Red Teaming Analyst
• CertificationCertified Multi-Cloud Blue Team Analyst
• ServicePenetration testing

Mobile application testing

• ServicePenetration testing
• RoleSenior security researcher, Eminence Ways

Business logic and abuse testing

Flaws that tools don't find, such as quota limits

• Write-upMEGA's unlimited cloud storage vulnerability

Reconnaissance and search engine dorking

• Case noteGHDB-ID 4997: finding exposed application secrets

Hardware hacking

Circuit boards, SPI flash and UART

• Write-upHardware hacking: bridging the cybersecurity gap
• Write-upGetting started with hardware hacking: tools
• RoleVolunteer community leader, OWASP Kathmandu chapter

Detection engineering and SIEM

• CertificationCCNA CyberOps
• ServiceSecurity operations
• RoleCo-founder, CryptoGen Nepal

Malware analysis

Android trojans and malicious files spread through social media

• Case noteAnalysing the “Nepali Girl” Android trojan
• Write-upNepali Girl: trojan analysis
• Write-upFacebook SVG Locky ransomware analysis
• ServiceSecurity operations

Incident handling and digital forensics

• ServiceSecurity operations
• RoleCo-founder, CryptoGen Nepal

Cloud defence

• CertificationCertified Multi-Cloud Blue Team Analyst

Network security

• CertificationCertified Network Security Specialist
• CertificationNetwork Security Expert 1
• CertificationNetwork Security Expert 2

Information system audits

• ServiceGRC advisory
• RoleCo-founder, CryptoGen Nepal

ISO/IEC 27001

Gap assessments, audit readiness and lead auditing

• CertificationISO/IEC 27001:2022 Lead Auditor
• ServiceGRC advisory

PCI DSS

• CertificationCertified PCI Security Implementer

Security roadmaps and policy

Plans tied to business risk; policies people can follow

• ServiceGRC advisory

Agentic AI security

Prompt injection, data leakage, excessive agency and unsafe tool use in AI agents and LLM features

• ServiceAgentic AI security

Security automation

Workflows and tools for repetitive tasks

• Write-upNavigating the regex maze with ease: ReGen
• ServiceAgentic AI security

Python

Tooling, exploitation and automation

• Write-upFrom PyCon JP 2024 speaker to PyCon JP 2026 organiser
• Write-upNavigating the regex maze with ease: ReGen

JavaScript and PHP

Proof-of-concept exploits and payloads

• Write-upReflected XSS leading to CSRF bypass and account takeover
• Write-upCVE-2021-3258: stored XSS and account takeover in Q2A

Hardware tools

Flipper Zero, SPI flash programmers, USB-UART adapters, multimeters

• Write-upGetting started with hardware hacking: tools

Android analysis with ADB

• Write-upNepali Girl: trojan analysis

Penetration testing and red team teaching

• CertificationAWS Academy Educator
• ServiceTraining and speaking
• RolePart-time lecturer, Softwarica College of IT & E-commerce

National exercises and workshops

• Case noteNational Cyber Drill, March 2025
• ServiceTraining and speaking

Conference talks

• Write-upFrom PyCon JP 2024 speaker to PyCon JP 2026 organiser
• ServiceTraining and speaking