Dheeraj Kumar Jayaswal — CEH-certified penetration tester with 15 years in IT and 5.6 years focused on offensive security. I test web applications and APIs the way an attacker would, and read the code the way a developer would — because I used to be one full-time.
Generic pentesting checks for missing headers. Domain-aware pentesting checks whether the business logic can be abused — because every industry hides its crown jewels somewhere different.
Protects account balances, fund transfers, KYC data
Watch class: Broken authZ on transaction & role endpoints
Protects PAN/taxpayer records, filing history, refunds
Watch class: IDOR on document & assessment IDs
Protects pricing logic, cart totals, coupon engines
Watch class: Client-trusted price/quantity params
Protects store-level inventory, loyalty balances
Watch class: Cross-tenant data leakage between stores
Protects exam integrity, grades, student records
Watch class: Session/timer manipulation, answer key exposure
Protects shipment manifests, consignee PII, routes
Watch class: Sequential tracking-ID enumeration
Spanning banking, ecommerce, government tax filing, freight & port logistics, automotive, recruitment tech, AI platforms, engineering software, education, and media streaming. Client names and identifying details are withheld under NDA — findings are described by pattern, not by target. Severity ratings follow CVSS-informed internal triage. Click a row to expand.
A role-update endpoint trusted the role field submitted by the client instead of validating it server-side, allowing any authenticated user to self-elevate to an administrative role.
Full access to other customers' accounts, transaction history, and fund-transfer functions — the core of the platform's trust model.
Server-side role enforcement added; fix verified and closed within 48 hours of disclosure.
The checkout API recalculated totals using unit prices sent by the client rather than re-pricing against the product catalog, so a modified request could check out at an arbitrary price.
Direct revenue loss at scale if automated — no purchase limit or server-side re-validation caught it.
Server-side price recalculation enforced on every order; regression test added to the release pipeline.
Filed-document downloads were referenced by a predictable numeric ID with no ownership check, so incrementing the ID returned other taxpayers' filings.
Mass-enumerable exposure of PAN-linked financial documents across the taxpayer base.
IDs replaced with non-sequential references bound to an ownership check; retested and confirmed remediated.
The tracking API accepted sequential shipment IDs and returned full manifests, including consignee name, phone number, and delivery address, without verifying the requester's relationship to that shipment.
Bulk scraping of customer PII across the carrier's entire shipment volume was possible with a simple loop.
Rate limiting plus per-shipment authorization added; tracking tokens moved to non-guessable identifiers.
Exam duration was enforced client-side in JavaScript; intercepting and replaying the submission request after the visible timer expired still recorded a valid, on-time answer.
Undermined exam integrity for a platform used in certification-grade assessments.
Server-side exam-window validation added, rejecting any submission after the authoritative deadline.
A telematics service shipped with a hardcoded API key inside client-side code, granting access to a backend endpoint that returned live vehicle location and trip history for other VINs.
Potential real-time tracking of any vehicle in the fleet, a serious physical-safety and privacy concern beyond typical data exposure.
Key rotated out of client code, moved behind a server-side proxy with per-vehicle authorization; retested and closed.
A resume/profile export endpoint accepted a candidate ID with no ownership check, letting any logged-in recruiter account pull full resumes and contact details for candidates outside their own applicant pool.
Mass export of job-seeker PII was possible across the platform's entire candidate database.
Ownership validation added on export; access logging introduced to detect bulk-pull patterns going forward.
An internal-facing model inference route was reachable without a valid session token, exposing metered, paid AI functionality and portions of the underlying prompt template.
Unbilled usage at scale, plus partial disclosure of proprietary prompt engineering that underpinned the product's core feature.
Authentication enforced at the gateway layer; prompt templates moved server-side only.
A file-sharing module for CAD projects scoped access by a client-supplied project ID rather than validating the requesting user's tenant, allowing one company's proprietary design files to be fetched using another's ID.
Exposure of confidential product designs across unrelated client organizations sharing the same platform — an IP-theft-grade finding.
Tenant-bound authorization enforced on every file fetch; retested with multi-tenant test accounts to confirm isolation.
A container-tracking API used by a major European port operator returned full cargo manifests, including customs declarations and consignee details, to requests with no authentication check at all.
Sensitive trade and customs data for cross-border shipments was fully enumerable — a critical concern given the operational and regulatory sensitivity of port logistics.
Endpoint moved behind authenticated, scoped API access; anomaly alerting added for bulk manifest queries.
A streaming platform's player trusted an entitlement flag embedded in a client-side token to decide whether premium content could play, rather than re-validating the subscription server-side per request.
Modifying the token allowed premium/paid content playback without an active subscription.
Entitlement checks moved server-side on every playback request; token signing hardened to prevent tampering.
Most pentesters read code to find bugs. I've shipped code for a living — so I know which shortcuts a deadline actually tempts a developer into taking.
Open to penetration testing engagements, security consulting, and domain-specific assessments across banking, ecommerce, retail, income tax, education, and logistics platforms.