The two results I'd show you first are the ones that killed my own hypothesis.

My prompt-injection work looked like a clean win — 6.1% bypass for one defense tier, 7.6% for the other — until I computed the interval and found the two don't separate at all. My GPT-2 probe looked like it decoded instruction provenance until I found the length confound I'd built into my own design; that one ended in a null. Both are published here with the numbers that make them look worse.

I build security tooling in Go and eBPF, hunt bugs on HackerOne and Intigriti, and report what the measurement actually says. CS undergrad at Scaler School of Technology in Bengaluru, degree from BITS Pilani, graduating 2027.

sentinelx — self-hosted EDR plus a lightweight SIEM, in Go, C and eBPF. Endpoint telemetry gets correlated into a per-host provenance graph, so an investigation is a subgraph you can walk instead of a pile of alerts to sort. No LLM anywhere in the detection path, on purpose.

theknight — AWS misconfiguration scanner that opens the fix as a pull request. Every scanner will tell you the bucket is public. This one sends the Terraform diff that closes it.

prompt-injection-soc-telemetry — the corpus and harness behind the result above. 66 payloads, three narrator defense tiers, an LLM judge I had to rebuild mid-run after finding a confound in it. Where the tiers do separate is severity: the structurally grounded one never downgraded a severity in its own voice, 0 out of 31, and that held on a second model when the prompt-hardened tier's advantage didn't.

instruction-provenance-probe — the mechanistic version of the same question. Is "this instruction came from the operator" versus "this one came from retrieved data" linearly decodable from GPT-2's residual stream? Linear probes and activation steering in PyTorch, and a null result I wrote up anyway.

• CyberML — forecasts next-week attack risk for public-facing services from honeypot telemetry, Shodan exposure, CVE feeds and PoC-exploit tracking.
• JobBoard — React, TypeScript and Supabase, with separate employer and candidate flows. Live.
• RAG — corrective-RAG document Q&A. When the grader says the retrieved chunks don't answer the question, it re-retrieves rather than guessing.
• SpringBootFinalProject and rideshare — Spring Boot backends with JWT auth, role-based access and Docker Compose.
• Java low-level design: movieticketlld (concurrency-safe seat locking, with the race-condition tests), elevatorlld, parkinglotlld.

Three merged, the rest open — links so you can check the state yourself.

• coreruleset #4774 — merged. Rule 934200 covered {{...}}, #{...} and <%...%> but had no alternative for Velocity or FreeMarker directive syntax, so working RCE chains in both engines reached paranoia level 1, the default, with no rule matched. The Java rules fall one at a time to splitting a string literal: the class-name list to 'java.lang.Runt'+'ime', the runtime|processbuilder regex to 'getRunt'+'ime', the PHP function regex to 'ex'+'ec'. Reported as #4773 with both payloads executing under Velocity 2.3 and FreeMarker 2.3.32, fixed with two assembly blocks and 11 regression tests. Full go-ftw matrix green, 5116/5116 on both engines.
• wstg #1506 — merged. The Web Security Testing Guide's SSTI section probes only interpolation syntax ({{ }}, ${ }, <% %>), so a tester following it misses Velocity and FreeMarker, which evaluate directive syntax. Adds probes for both, verified to render 49 under Velocity 2.3 and FreeMarker 2.3.32, and warns that a bare directive returns no output — an unchanged response is not evidence the payload did not run. Also replaces Tplmap, whose last commit was 2021, with the maintained fork.
• garak #2146 — merged. NVIDIA's LLM red-teaming framework, 9k★. SurgeProfanityRacialEthnic requested a CSV category key that doesn't exist; surge_list is a defaultdict, so the typo never raised — it silently built the detector with zero substrings. garak's racial/ethnic slur detector had been matching nothing at all. Fixed the key and added a test asserting every wordlist-backed detector actually receives terms, so the same silent-empty failure can't recur under a different typo. Reported as #2145.
• garak #2144 — open, pending maintainer review. StringDetector's word-boundary regex (\b) can't match a term that itself starts or ends with a non-word character, so 14 shipped profanity-list entries — the leetspeak/symbol obfuscations the list exists to catch — silently scored clean; fixed with lookaround boundaries. Regression test proven to fail on the unpatched code; full detector suite green, 780 passed.
• CheatSheetSeries #2393 — the LLM Prompt Injection cheat sheet grades defenses with a block rate over 14 payloads and calls it a "Security score", with no benign corpus and a pass condition that substring-matches refusal wording. Proposed replacing it with something that has controls and reports an interval.
• Two guard bypasses in Agent Memory Guard (an OWASP Incubator project), reported privately with patches and regression tests, held until the maintainer replies.
• A security-boundary gap in OWASP ZAP's llm add-on, reported privately per their disclosure policy with a proof-of-concept and a proposed fix; awaiting response.

HackerOne and Intigriti. The findings that get paid are almost always the same shape: an unauthenticated path into a function that assumed nobody could reach it from outside.

Site · LinkedIn · jainhitarth963@gmail.com