B.Tech Information Technology · ABES Engineering College (2027) · Delhi NCR
I build backend systems, developer tools and real-time applications —
with a focus on security, correctness and implementations I understand from first principles.
Nexus — Git-style VCS, built from scratchNo git binary. No libgit2.
|
CareerRadar — TypeScript monorepo, 12 integrationsContract-first: OpenAPI 3.1 generates Zod validators + React Query hooks.
|
Bridge — WebRTC platform, hand-built session security
|
Syllora — Full-stack EdTech marketplace
|
Ran a cross-repository audit and fixed 7 classes of security defects — credential exposure in public API responses, unauthenticated destructive routes, missing object-level authorization, unsafe token handling. Three fixes include dedicated regression suites.
What I found →
| Defect class | Where |
|---|---|
| bcrypt hash exposed via unauthenticated public endpoint | Nexus · Syllora |
| JWT accepted from request body | Syllora |
| Unauthenticated scheduler-trigger routes (outbound amplification vector) | CareerRadar |
| Entire route module — no authentication, no ownership checks | Nexus |
| Credential fields returned to authenticated callers | Syllora |
| Unauthenticated sync routes firing external requests | CareerRadar |
| Refresh + CSRF tokens stored as plaintext | Bridge |
Three defects were found by treating one discovery as a class and grepping every other codebase for the same pattern.
Backend Node.js · Express · REST · OpenAPI 3.1
Systems SHA-256 content addressing · commit DAGs · BFS traversal · LCS diff
Data PostgreSQL · MongoDB · Drizzle ORM · Mongoose
Real-time WebRTC · Socket.IO · WebSockets · background schedulers
Security JWT · refresh-token rotation · CSRF · bcrypt · RBAC · Zod
Testing Vitest · Jest · Playwright · Node test runner · 137 tests across 4 projects
Tooling Git · Linux · GitHub Actions · pnpm · Render · Vercel