Currently active — learning Arch from the ground up, prepping for hackathons
Shivansh
Self-taught security researcher and builder, now working from a Linux laptop setup.
Recon automation, Linux tooling, and responsible disclosure — documented in public rather than performed. I write down what breaks, not just what ships.
About
How the work happens
Almost everything here started on a five-inch screen. Termux was the first real instrument — a full Linux shell folded into an Android phone, no proper keyboard, no patience for shortcuts.
That constraint turned into a method: build tools that work where the environment refuses to cooperate, then confirm they hold up everywhere else. A phone forces you to know which parts of a system are essential and which are decoration — there's no room to carry dead weight.
The work has since moved onto a proper Linux laptop, which changed the problem rather than removing it. Remote access is the clearest example: my ISP puts me behind CGNAT, so plain SSH into the machine was never going to work. It runs through a Cloudflare Tunnel with Tailscale handling SSH instead — a fix that only made sense after I understood why the direct route was failing.
I'm self-taught, which mostly means I've broken more things than I was ever taught not to. It's a slow way to learn, but it's an honest one — every fix comes with a reason attached.
- Primary
- Linux laptop · Arch
- Desktop
- KDE Plasma, configured from scratch
- Origin
- Android · Termux
- Languages
- Python · Bash · JavaScript
- Editor
- Neovim
- Remote
- Cloudflare Tunnel · Tailscale SSH
- Method
- Write → break → document → fix
- Now
- Arch config, Node projects, hackathon prep
Security Research
Black-box assessments across government infrastructure and private firms. Reconnaissance first, exploitation only where scope allows, and a written report at the end — Confirmed, Probable, or Hypothesis, never blurred together.
Recon & Automation
Chaining open-source tooling — recon-ng, ReconFTW, subfinder, httpx, nuclei, katana, gau, waybackurls, ffuf — into pipelines that survive a second run. The automation is the point; the tools are interchangeable.
Red / Blue Practice
Which side I'm on depends on the project. Some work is building detection logic, some is trying to walk past it, and the useful part is keeping notes on what each side missed about the other.
Learning Arch properly — installation, configuration, and customisation from the base up rather than from an install script. Alongside that: a Node.js OSINT project, recon automation with recon-ng and ReconFTW, and preparing for hackathons. New projects start most weeks; the ones that survive end up here.
Currently exploring
The sources I keep going back to are mostly primary ones — man pages, GNU coreutils, the RFCs behind DNS and HTTP, PortSwigger's research write-ups, and the nuclei template repo when I want to see how other people encode a check.
Experience
Disclosure, recon, and the long way around
No job titles here — this is what I've actually done, who it was reported to, and how I handle a finding once I have one.
Vulnerability disclosure — government infrastructure
OngoingFound and reported vulnerabilities across Indian government infrastructure through coordinated disclosure. Reconnaissance first, verification before write-up, and a CERT-In-aligned report at the end. Targets aren't named here and won't be.
Vulnerability disclosure — private firms
OngoingThe same process applied to private organisations: assess within scope, reproduce cleanly, report in plain language, and wait on their timeline rather than mine. A finding that can't be reproduced twice doesn't get sent.
Recon automation with open-source tooling
OngoingBuilding and tuning recon pipelines around recon-ng and ReconFTW — subdomain enumeration, HTTP probing, and vulnerability scanning chained into one pass, then hand-verified before anything reaches a report. Scanner output is a starting point, not a finding.
Red and blue team practice
Project-dependentWhich side I work depends on what the project needs. Building detection logic teaches you what attackers leave behind; trying to get past it teaches you what defenders assume. Doing both is what makes either one useful.
Networking in hostile conditions
Learned the hard wayMy ISP puts me behind CGNAT, which quietly breaks anything that expects a reachable public address — SSH into my own machine included. Working through it meant actually understanding NAT traversal, IPv6 availability, and why a connection times out instead of refusing. The setup now runs on a Cloudflare Tunnel with Tailscale SSH, and that whole detour taught me more about networking than any tutorial did.
Linux from the base up
In progressMigrated off Android/Termux onto a Linux laptop, and I'm learning Arch by building it rather than installing it — packages, configuration, and customisation done deliberately so I know what every piece is doing and why it's there.
Verify before you write. I don't report anything I can't reproduce cleanly. Every report includes a clear reproduction, the affected system, and no speculation about impact I can't prove — findings are graded Confirmed, Probable, or Hypothesis, and the grade stays honest even when it's less impressive.
I document conservatively — what I observed, not what I suspect — and I wait on organisational timelines rather than mine. Disclosure is a conversation, not a deadline. I've reported across government infrastructure and private firms, and I don't name targets here.
— this is the ethic that separates research from noise.
Toolbox
What I reach for
Listed honestly — familiarity, not mastery. The recon and terminal groups are daily drivers; the rest I reach for when a project needs them.
// tools change, method doesn't.
Field Reports
Work in the field
Field reports. Some are shipping, some are half-built, one is mostly a directory of notes so far — the status pill says which is which.
Transmit
Say hello
Open to conversations about recon automation, disclosure workflows, OSINT tooling, or debugging Bash at 2am.