5h4d0wn1k - Tech lead & founder building 198+ open-source secu

项目说明

<di="center">

<!-- ── Header wave ─────────────────────────────────────────── -->
<img src=" width="100%" alt="Nikhil Nagpure" />

<!-- ── Typing rotator ──────────────────────────────────────── -->
<img src=" width="100%" alt=" Research &amp; Coordinated Disclosure, Memory Safety &amp; Fuzzing, Offensi Practitioner, AI/LLM Security Engineering, Hardware &amp; Wireless Pentesting, 97 Merged Upstream PRs" />

<!-- ── Stats strip ─────────────────────────────────────────── -->
<img src=" alt="Profile views" />
&nbsp;&nbsp;
<a href=" src=" alt="Followers" /></a>
&nbsp;&nbsp;
<a href=" src=" alt="249 repositories" /></a>
<a href=" src=" alt="1,025 stars" /></a>
&nbsp;&nbsp;
<img src=" alt="6 merged pull requests to independent open-source projects" />
&nbsp;&nbsp;
<img src=" alt="License" />

<br/>

<p>
<a href=" src=" alt="LinkedIn-0A66C2?style=for-the" /></a>
<a href=" src=" alt="GitHub-111827?style=for-the" /></a>
<a href=" src=" alt="Portfolio-0891b2?style=for-the" /></a>
<img src=" alt="Profile last updated" />
<a href="mailto:"><img src=" alt="Email-EA4335?style=for-the" /></a>
</p>

</div>

---

🛡️ About Me

Security engineer and researcher. I find memory-safety and
authorization-boundary defects in widely-deployed infrastructure — cluster control
planes, network-facing daemons, and serialization libraries — and work with upstream
maintainers and security response teams to get them fixed.

My work is e: every finding ships with a sanitizer transcript or a
failing upstream test, a duplicate check, and a tested fix. Google has re and
publicly released one of my reports; another is in review with the Go project.
6 merged pull requests to independent open-source projects — Go, protobuf, SymPy, TheAlgorithms/Python, freeCodeCamp, free-programming-books — plus 57 merged across my own production and open-source organisations.

Alongside that I build and maintain the tooling — ~200 open-source offensive and
defensi tools, secure full-stack products, and hardware wireless kits —
with a focus on systems that stay maintainable as they grow.

<table>
<tr>
<td width="200" align="center"><b>Identity</b></td>
<td>
<b>Nikhil Nagpure</b> · <code>5h4d0wn1k</code><br/>
_{🌍 Open to relocation & frequent travel · always exploring somewhere new}
</td>
</tr>
<tr>
<td align="center"><b>Education</b></td>
<td>B.Tech CSE — Cybersecurity & Digital Forensics, (2021–2025) · <b>CGPA 8.33/10</b></td>
</tr>
<tr>
<td align="center"><b>Now</b></td>
<td>
Technical Lead @ <b>CuboidSoft</b> ·
Founder @ <b>Shadownik</b> ·
Founding SWE @ <b>Pawan Technologies</b><br/>
_{Pre: Offensi Intern @ InLighnX · Ethical Hacking Intern @ Internship Studio}
</td>
</tr>
<tr>
<td align="center"><b>Focus</b></td>
<td>
<b> Research · Memory Safety · Fuzzing</b> · Offensi · Red Teaming · API Security · AI/LLM Security · Hardware-Wireless Pentesting · Secure Full-Stack
</td>
</tr>
<tr>
<td align="center"><b>Building</b></td>
<td>
<b>ApiSecPlatform</b> (enterprise API security testing) ·
<b>Portable Wireless Pentest Toolkit</b> (ESP32-based) ·
<b>SentinelWall</b> AI threat detection
</td>
</tr>
</table>

<p align="center">
<b>Focus areas</b>
<br/>
<img src=" alt=" Research-9f1239?style=flat-square" />
<img src=" alt="Memory Safety-c026d3?style=flat-square" />
<img src=" alt="Fuzzing-7c3aed?style=flat-square" />
<img src=" alt="Offensi?style=flat" />
<img src=" alt="Red Teaming-darkred?style=flat" />
<img src=" alt="API Security-22d3ee?style=flat" />
<img src=" alt="LLM Security-a21caf?style=flat" />
<img src=" alt="Hardware &amp; Wireless-14b8a6?style=flat" />
<img src=" alt="Secure Full--Stack-eab308?style=flat" />
</p>

<p align="center">
<b>Core stack</b>
<br/>
<img src=" alt="Python-3776AB?style=flat" />
<img src=" alt="TypeScript-3178C6?style=flat" />
<img src=" alt="C++-00599C?style=flat" />
<img src=" alt="Solidity-363636?style=flat" />
<img src=" alt="Go-00ADD8?style=flat-square" />
<img src=" alt="C-A8B9CC?style=flat-square" />
<img src=" alt="Rust-000000?style=flat" />
<img src=" alt="Dart-0175C2?style=flat" />
<img src=" alt="SQL-4479A1?style=flat" />
<img src=" alt="Ja?style=flat" />
</p>

<p align="center">
<b>Certifications</b>
<br/>
<img src=" alt="CEH-e63946?style=flat" />
<img src=" alt="CNSP-457b9d?style=flat" />
<img src=")-6d6875?style=flat-square" alt="PEH (TCM)-6d6875?style=flat" />
<img src=")-2a9d8f?style=flat-square" alt="IELTS 7.5 (C1)-2a9d8f?style=flat" />
</p>

<p align="center">
<b>Communities</b>
<br/>
<img src=" alt="DEFCON Franklin Security-black?style=flat" />
<img src=")-1f5c8b?style=flat-square" alt="Cyber Expert - Ministry of Home Affairs (India)-1f5c8b?style=flat" />
</p>

---

🔬 Security Research & Disclosure

I research memory-safety and authorization-boundary defects in widely-deployed infrastructure — cluster control planes, network-facing daemons, and serialization libraries. The bar I hold: a finding is real when it reproduces under a sanitizer or fails an upstream unit test, and it ships with a tested fix. A theoretical attack scenario is not a finding.

Method: source audit of bounds/length handling → minimal reproducer → ASan/UBSan confirmation → duplicate check → private disclosure → fix.

Publicly disclosed work

<table>
<tr>
<td width="26%" ="top"><b>protobuf-java</b><br>_{Google · gRPC}</td>
<td ="top">
Integer-o and silent-truncation audit of <code>Timestamps.parse</code> in the Ja parser.
O timezone offsets o and wrap; <code>&gt;9</code> fractional digits are silently truncated —
producing a different-but-valid <code>Timestamp</code> with no error, inconsistent with the C++ parser.
<br><br>
<a href=" #30276</b></a> ·
<a href=" #30277</b></a> _{(+99/−10, awaiting review)}
<br>_{Reported to Google VRP (ref 567495093); Google re it and released it for public disclosure.}
</td>
</tr>
<tr>
<td ="top"><b>Go stdlib</b><br>_encoding/xml</td>
<td ="top">
<code>xml.Marshal</code> and <code>EncodeToken</code> emit <b>ill-formed element and attribute names
while returning a nil error</b> — invalid XML leaves the encoder with no way for callers to detect it.
Standard library, affects every Go program using <code>encoding/xml</code>.
<br><br>
<a href=" #81881</b></a> ·
<a href=" 841865</b></a> _{(under review)}
</td>
</tr>
</table>

Also under private disclosure

Additional findings in Kubernetes admission control and embedded/network daemon memory safety are in
coordinated private disclosure with the respecti response teams. Details are a on request
once each ad is published.

> Disclosure policy: no finding is made public before the affected project has had a fair opportunity to
> ship a fix. Undisclosed reports are ne publicly, including here.

---

🧰 Tech Stack

<p align="center">
<img src=" alt="Python-3776AB?style=for-the" />
<img src=" alt="TypeScript-3178C6?style=for-the" />
<img src=" alt="C++-00599C?style=for-the" />
<img src=" alt="Solidity-363636?style=for-the" />
<img src=" alt="Dart-0175C2?style=for-the" />
<img src=" alt="Rust-000000?style=for-the" />
<img src=" alt="Next.js-000000?style=for-the" />
<img src=" alt="Linux-FCC624?style=for-the" />
<img src=" alt="Docker-2496ED?style=for-the" />
<img src=" alt="Offensi?style=for-the" />
<img src=" alt="Hashcat-123456?style=for-the" />
<img src=" alt="KaliLinux-557C94?style=for-the" />
</p>

---

🚀 Featured Projects

| Project | Description | Stars |
|---------|-------------|-------|
| photo-organizer | Local-first, pri photo & video library — Rust daemon + Flutter desktop, SQLCipher vault, ChaCha20-Poly1305 encryption, OCR & scene search, P2P LAN sync | !Stars |
| Decentralized Cloud Storage | Blockchain-backed decentralized storage — Solidity smart contracts sharing encrypted file references with on-chain access control | !Stars |
| ML Web-Attack Detection | ML-powered web-attack detection — phishing URL, DoS intrusion & XSS classification | !Stars |
| cybersecurity-framework | Interactive map of e in cybersecurity — 27 domains, 776 categories, 1,067 curated offensive & defensi | !Stars |
| ApiSecPlatform | Enterprise API security platform for automated testing, threat insights, and OWASP-aligned checks | — |
| Portable Wireless Pentesting Toolkit | ESP32-based field pentesting device for wireless assessments and protocol testing | — |

---

🧨 Flagship Security Toolchain (Shadow Kitchen)

The current effort — autonomous offensi security tooling for authorized labs. Every tool ships with docs, tests, and explicit legal-use boundaries.

| Tool | What it does |
|------|--------------|
| sentinelwall | Autonomous AI network threat detection & correlation — MITRE ATT&CK mapping, ML anomaly detection, rule DSL, STIX/Na/HTML exports |
| mythicforge | Ad LLM prompt-injection & jailbreak testing — 37 techniques, OWASP/NIST/MITRE ATLAS benchmarks, SARIF reports |
| shadowvault | Cryptographic secrets lifecycle manager — AES-256-GCM vault, OPSEC zeroize, team RBAC, migration tools |
| hermesc2 | C2 & post-exploitation research framework (lab) — listeners, stagers, beacons, encrypted transport, killswitch, offline loopback-only demo |
| | MCP (Model Context Protocol) ser auditor — AST/whitebox SAST for agentic AI tool handlers, SARIF-capable |
| crownjewel | Cross-cloud identity federation auditor — Golden/Silver SAML, OAuth client-ID spoofing, OIDC , offline fixtures |
| aiarsenal | Ad AI/ML security studio — data poisoning, model backdoors, extraction, membership inference, prompt injection, agentic red-team planner |
| webbreach | OWASP Top-10 web exploitation framework — built-in localhost targets, AI-guided scan queue |
| cloudpwn | Cloud & container penetration suite — AWS/GCP/Azure enumeration, docker leaks, k8s secrets, terraform audit, CSPM |
| supplysec | Supply-chain security gate — SBOM (CycloneDX/SPDX), offline ad matching, policy gates, post-quantum scanning |
| toxindb | RAG retrie poisoning detector — canary injection, pro attestation, SARIF+MD reports |
| honeynet | Honeypot farm + deception grid — multi-protocol honeypots, attacker fingerprinting, dwell/risk scoring, quarantine |

> 198+ catalog security tools and counting — see the security tool catalog. For more flagships: cryptocrack, grainrecon, exploitcraft, mobsek, endpointaegis, netpwn, wiair, socialforge, sprayshed, rogueai, postpwn, and the w/m/c/d/f/h/i/n/p/r/se/web/x/ai/cl coded series. All for authorized testing only.

---

👨‍💻 Experience

Technical Lead — CuboidSoft (Jan 2025 - Present)

Founder — Shadownik · Freelance (Jun 2024 - Present)

Founding SWE — Pawan Technologies (Sep 2025 - Feb 2026)

Offensi Intern — InLighnX Global Pvt. Ltd. (Jun 2025 - Dec 2025)

Ethical Hacking Intern — Internship Studio (Nov 2023 - Dec 2023)

---

🌍 Open Source Contributions

<table>
<tr><td width="40%"><b>Contributions</b></td><td><b>3,600+</b> in the last 12 months</td></tr>
<tr><td><b>Pull Requests</b></td><td>237 authored · <b>177 merged</b> · <b>6 merged to independent OSS</b> · 57 merged to my own orgs</td></tr>
<tr><td><b>Repos on GitHub</b></td><td>249 · 231 built from scratch · <b>1,025 stars</b></td></tr>
<tr><td><b>Organizations</b></td><td>3 orgs · 20 repos (Shadownik · Cuboidsoft · CuboidPilot)</td></tr>
</table>

Independent open-source projects

Bugs found by reading the code, reproduced with a failing test, and fixed with a patch
upstream maintainers can review and merge. These are the projects that accepted my work.

<table>
<tr>
<td width="22%" ="top"><b>golang/go</b><br>_{Go standard library}</td>
<td ="top">
<code>xml.Marshal</code> and <code>EncodeToken</code> emit <b>ill-formed element and
attribute names while returning <code>nil</code> error</b> — callers get invalid XML with
no way to detect it. Reached from every Go program using <code>encoding/xml</code>.
<br><a href=" #81881</b></a> ·
<a href=" 841865</b></a>
<br>_{🟡 open — 3 comments, maintainer cross-linked the related family}
</td>
</tr>
<tr>
<td ="top"><b>protocolbuffers/protobuf</b><br>_{Google · gRPC}</td>
<td ="top">
Integer o and silent truncation in Ja <code>Timestamps.parse</code>:
o timezone offsets wrap, <code>&gt;9</code> fractional digits are dropped, and the
parser returns a <i>different but </i> <code>Timestamp</code> with no error —
inconsistent with the C++ parser. Found audit; fixed with tests.
<br><a href=" #30276</b></a> ·
<a href=" #30277</b></a> _(+99/−10)
<br>_{🟡 open — mergeable, awaiting maintainer review. Google it for public disclosure.}
</td>
</tr>
<tr>
<td ="top"><b>SymPy</b></td>
<td ="top">
<code>solve</code> returned solutions outside the domain of a denominator — e.g.
<code>x/log(x)</code> returned complex and non-positi that cannot satisfy the
original equation, silently.
<br><a href=" #30567</b></a>
<br>_{🟢 <b>merged</b>}
</td>
</tr>
<tr>
<td ="top"><b>TheAlgorithms/Python</b></td>
<td ="top">
Made <code>re</code> and <code>odd-e sort</code> generic over
comparable items, so both work for any ordered type rather than <code>int</code> only —
removing an artificial type restriction in two widely-copied algorithm implementations.
<br><a href=" #15402</b></a> ·
<a href=" #15405</b></a>
<br>_{🟢 <b>both merged</b>}
</td>
</tr>
<tr>
<td ="top"><b>freeCodeCamp</b></td>
<td ="top">
Corrected a wrong truthy/falsy example and its wording in the Ja curriculum —
a concept error in material used by millions of learners.
<br><a href=" #70289</b></a>
<br>_{🟢 <b>merged</b>}
</td>
</tr>
<tr>
<td ="top"><b>EbookFoundation/<br>free-programming-books</b></td>
<td ="top">
Repaired dead <code>turing.com.br</code> links across the book lists by resolving them
through the Wayback Machine.
<br><a href=" #13472</b></a>
<br>_{🟢 <b>merged</b>}
</td>
</tr>
</table>

Open pull requests

| Project | Finding |
|---|---|
| pandas | <a href=" — <code>GroupBy.agg</code> with <code>as_index=False</code> and a MultiIndex column group produces a wrong result shape |
| scipy | <a href=" — <code>sparse.csgraph</code> mishandles duplicate CSR entries in bipartite matching |

Professional open-source work

Beyond upstream contributions, 57 merged pull requests across organisations I build and
maintain — CuboidSoft, CuboidPilot and TCM-ONE. This is production infrastructure work:
removing leaked credentials from tracked git history, pinning third-party CI actions to
immutable re, gating production deploys on domain test suites, re R2 shadow
writes for account migration, and automated Android release delivery with a self-repairing
rollback path. _{Listed separately because employer and owned repositories are not
independent third-party review.}

---

📊 GitHub Analytics

<di="center">
<img src=" width="100%" alt="Profile Summary" />
<br/><br/>
<img height="160em" src=" alt="GitHub statistics summary card" />
<img height="160em" src=" alt="Repositories per language summary card" />
<img height="160em" src=" alt="Most committed language summary card" />
<br/>
<img src=" alt="Streak Stats" />
<br/>
<img src=" width="100%" alt="Contribution Heatmap" />
</div>

---

🏆 Certifications & Highlights

---

📬 Let's Connect

<p align="center">
<a href=" src=" alt="LinkedIn-0A66C2?style=for-the" /></a>
<a href=" src=" alt="GitHub-111827?style=for-the" /></a>
<a href=" src=" alt="Portfolio-0891b2?style=for-the" /></a>
<a href="mailto:"><img src=" alt="Email-EA4335?style=for-the" /></a>
</p>

---

<di="center">

*"Build secure systems. Solve real problems. Create measurable impact."*

<img src=" width="100%" alt="Thanks for " />

</div>

项目信息

开发语言：未知

Star 数：6

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Tech lead & founder building 198+ open-source security tools, offensive/defensive tooling, and secure full-stack systems. Student of AI/LLM security and wireless hardware.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。