Offensive Security Researcher · Bug Bounty Hunter
I find vulnerabilities in the applications of companies like Apple, Google, Microsoft, Goldman Sachs, SpaceX and GitHub — most of it inside private, invitation-only bug bounty programs. Six years on HackerOne: top-1,000 all-time, HackerOne Clear, 131 paid bounties. I work AI-augmented: my own harnesses, built around Claude and Codex, run reconnaissance, triage and reporting at a scale one hunter couldn't reach by hand.
Open to penetration testing, red teaming and vulnerability research roles · remote worldwide or relocating · GMT+6
A bug in every wave.
Move to disturb the water01 The record
Reputation, rank, signal and impact are checkable on my public HackerOne profile; report, severity and bounty counts come from my HackerOne account.
02 Highlights
Most of my work is under private-program terms and can't be written up. These are the results that are on the record — dated, and linked to the source where one exists.
03 Every wave
Every mark below is a program that accepted at least one of my reports as valid — the public ones, on both platforms — or an organisation that lists me by name on its own acknowledgements page. Rendered in a single ink, so no logo shouts over another — and every mark links to the program's own page.
And these are only the ones I'm allowed to name. Most of my work is in private programs whose names are withheld, as their terms require.
04 What I find
Not a skills list. Six carry HackerOne's own badge — issued only on a valid report of that class; the other four are on my record as resolved or triaged reports.
Where some of my resolved-or-triaged reports landed, in HackerOne's own weakness classes:
05 Tools
Extracts hosts from Shodan and defeats the platform's hard ceiling of 1 000 results per query by recursively subdividing the search — country, then city, then port — until every bucket fits under the limit. Validates, strips reserved ranges, deduplicates.
A port scanner that never touches the target. Resolves open ports out of Shodan's InternetDB at ~500 requests a second with rotating user agents, so an entire estate can be mapped without a single packet reaching the asset owner.
I run offensive work through harnesses I built around Claude and Codex — agents wired to my own reconnaissance tooling that map an estate, triage what comes back, draft proofs of concept and write the report, with me steering every exploitation step. It is how one hunter keeps up with an attack surface that never stops growing.
Continuous external attack-surface mapping, folding Crunchbase, Shodan, Censys, Whoxy and crt.sh into one picture with custom reconnaissance on top.
06 Languages
Fluent in English and Bengali; conversational Hindi and Urdu — speaking and listening.
07 Say hello
That's my HackerOne researcher address — it forwards straight to my inbox, not a queue, and the handle is the same one on every profile below.