███████╗ █████╗ ███╗ ██╗ ██╗ █████╗ ██╗ ██╗ █████╗ ███╗ ██╗
██╔════╝██╔══██╗████╗ ██║ ██║██╔══██╗╚██╗ ██╔╝██╔══██╗████╗ ██║
███████╗███████║██╔██╗ ██║ ██║███████║ ╚████╔╝ ███████║██╔██╗ ██║
╚════██║██╔══██║██║╚██╗██║██ ██║██╔══██║ ╚██╔╝ ██╔══██║██║╚██╗██║
███████║██║ ██║██║ ╚████║╚█████╔╝██║ ██║ ██║ ██║ ██║██║ ╚████║
╚══════╝╚═╝ ╚═╝╚═╝ ╚═══╝ ╚════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═══╝
$ cat /etc/passwd | grep SanjayanV
SanjayanV:x:1337:1337:AppSec Researcher,Security Researcher:/home/SanjayanV:/bin/zshI break things before the bad guys do.
Application security researcher focused on supply chain attacks, web exploitation, CI/CD security, and Mobile Security. I hunt bugs, write CVEs, and build tools that make attack surfaces visible.
Production-grade authentication library in Go
A fully open-source auth framework implementing JWT, session-based auth, OAuth 2.0/OIDC, and API key management — designed as both a portfolio piece and a teaching resource for secure implementation patterns.
├── JWT (HS256/RS256, revocation strategies)
├── Session management (stateful, lifecycle hardening)
├── OAuth 2.0 / OIDC integration
├── API key management
└── CI/CD pipeline (SAST · Secrets · SBOM · Trivy · Dependency-Check)
🛡️ ChainSentry (In Development)
Supply chain security monitoring tool
Built on the methodology that discovered CVE-2026-0933 — ChainSentry detects malicious patterns in lockfiles, dependency manifests, and CI/CD pipeline configs before they reach your build.
Target attack surfaces:
package-lock.json · pnpm-lock.yaml · yarn.lock
.github/workflows · Dockerfile · requirements.txt
╔══════════════════════════════════════════════════════════════╗
║ RECON & DISCOVERY ║
║ subfinder · httpx · gau · amass · shodan ║
╠══════════════════════════════════════════════════════════════╣
║ EXPLOITATION ║
║ Burp Suite Pro · Nuclei · ysoserial · sqlmap · ffuf ║
╠══════════════════════════════════════════════════════════════╣
║ APPSEC / SAST ║
║ Semgrep · CodeQL · Trivy · Gitleaks · OWASP ZAP ║
╠══════════════════════════════════════════════════════════════╣
║ CLOUD / INFRA SECURITY ║
║ kubeaudit · kube-bench · truffleHog · Syft ║
╚══════════════════════════════════════════════════════════════╝
focus = {
"exploitation": ["SSRF", "XXE", "JWT attacks", "SSTI", "Deserialization"],
"infra": ["CI/CD attack surfaces", "GitHub Actions poisoning"],
"research": ["Lockfile injection", "Supply chain CVE hunting"],
"bounty": ["NordPass", "Rapyd"],
"goal": "AppSec Engineer role"
}| Domain | Techniques | Status |
|---|---|---|
| Web AppSec | SSRF, XXE, IDOR, SSTI, Deserialization, JWT | 🟢 Active |
| Supply Chain | Lockfile injection, dependency confusion, CI poisoning | 🟢 CVE Filed |
| Session Security | Fixation, hijacking, JWT revocation bypass | 🟢 Active |
| Infrastructure | K8s misconfig, container escape, secret leakage | 🟡 In Progress |
| DAST / Runtime | OWASP ZAP, dynamic pipeline scanning | 🟡 In Progress |
"Security is not a product, but a process." — Bruce Schneier