Security Analyst & VAPT Engineer · 12 published CVEs · Bug Bounty Hunter · Offensive Security
Abhishek Bhaskar (full name Abhishek Nandkumar Bhaskar), known online as Abhi HackZ, is a Security Analyst and VAPT Engineer from India with 5+ years of experience in offensive security. As Abhi HackZ, he tests web, API, mobile, cloud and AI systems the way real attackers would, and has secured over 1000 applications.
Abhishek Bhaskar holds Hall of Fame recognition from NASA for responsible vulnerability disclosure, is listed on six Bugcrowd VDP Halls of Fame (Vero, Progress Sitefinity, Chef, DevTools, DataDirect, MarkLogic), is the credited finder on 12 published CVEs assigned by Progress Software, from CVE-2026-91140 (Critical, CVSS 9.6, DataDirect) and CVE-2026-92931 (High, CVSS 8.8, Sitefinity) through the KendoReact, Kendo UI for Vue and Kendo UI for jQuery advisories — is the creator of the SentryScan vulnerability scanner, and hunts bugs on HackerOne and Bugcrowd under the handle abhi_hackz. Whether people search for Abhishek Bhaskar, Abhi HackZ or Cyber HackZ, this is the same person.
Looking to hire a freelance cybersecurity expert or an ethical hacker for hire? Abhi HackZ works as an independent freelance penetration tester — offering web and API pentesting, mobile app security testing, cloud VAPT, network assessments and AI/LLM red teaming for startups and founders worldwide, with fixed-price quotes and a free 30-minute scoping call.
SentryScan · SentryScan Mobile · Hall of Fame · CVEs · Projects · Blog · Certifications · Contact
I help founders find the breach before attackers do — testing web, API, mobile, cloud and AI the way real adversaries would.
5+ years in offensive security, 1000+ applications secured, Hall of Fame recognitions from NASA and others, and 12 published CVEs credited to Abhishek Nandkumar Bhaskar (Abhi-Hackz) by Progress Software. Whether you want a look at my work or a security partner for your product — you're in the right place.
Focus areas: Offensive Security, Bug Bounty, AI Red Teaming, Security Automation, VAPT Engineer, Freelance Pentesting, Ethical Hacking.
Freelance penetration testing and security assessment services for founders, startups and enterprises.
Full-depth testing of your web app and APIs — auth flaws, IDORs, injection, business-logic abuse and the chained attacks scanners never find.
Deliverable: prioritised report · PoC per finding · free retest
Static and dynamic assessment of your mobile apps — insecure storage, broken crypto, API trust issues and reverse-engineering resistance.
Deliverable: OWASP MASVS-mapped findings · fix guidance per issue
Configuration and privilege-focused review of your cloud environment — IAM misconfigurations, exposed storage and services, and insecure defaults across AWS, Azure and GCP.
Deliverable: cloud posture report · misconfig findings · hardening plan
External and internal assessments of your network and infrastructure — exposed services, misconfigurations, and wireless and IoT environments included.
Deliverable: attack-surface map · risk-ranked remediation plan
Shipping AI features? I test for prompt injection, data leakage, jailbreaks and agent/tool-abuse before your users — or attackers — do.
Deliverable: threat model · exploit scenarios · guardrail recommendations
Continuous discovery of everything you've exposed to the internet — forgotten subdomains, staging boxes, leaked keys and shadow assets — powered by custom recon pipelines and tooling.
Deliverable: live asset inventory · exposure report · reusable tooling
A tight, predictable VAPT engagement — from the first scope call through reconnaissance, manual and automated testing, exploitation with proof-of-concept per finding, a prioritised report your engineers can act on, and a free re-verification of every fix.
SentryScan is a self-hosted web vulnerability scanner and VAPT platform I'm building for authorized security testing. It maps the attack surface, runs 64 detection modules mapped to the OWASP Top 10 and other industry security frameworks (WSTG, SANS, PTES), actively proves real findings instead of just flagging them, drops the noise, and writes the report.
Detects: SQL injection, Reflected XSS, DOM XSS, LFI, SSTI, NoSQL injection, CRLF, Security headers, CORS misconfig, Clickjacking, Open redirect, Cache poisoning, .git / .env leaks, Swagger exposure, GraphQL introspection, JWT weaknesses and more.
SQLi (error, blind, time, header, auth-bypass), reflected & DOM XSS, LFI, SSTI, NoSQL and CRLF — driven from a JS-aware crawl.
Security headers, CORS, clickjacking, open redirect, cache poisoning, and .git/.env source leaks.
Swagger/OpenAPI exposure, GraphQL introspection, JWT weaknesses, plus full authenticated scanning for SPAs.
Non-destructively reconstructs each exploitable finding to prove it, scores confidence, and drives false positives toward zero.
An optional AI pass double-checks borderline findings to cut false positives even further before they reach your report.
Evidence, reproduction steps and working proofs, exported to HTML, PDF, Markdown, JSON or CSV.
Learn more about SentryScan · SentryScan Mobile for Android & iOS
Offensive Security · VAPT · Bug Bounty · 5+ years
Web App Security · Mobile App Security · API Security · Thick Client · Network VAPT · Infrastructure VAPT · Wireless Security · IoT Security
Recon Automation · Asset Discovery · Subdomain Enumeration · Vulnerability Chaining · Advanced Methodologies · Report Writing
Prompt Injection · LLM Security Testing · AI Red Teaming · Agent Security · AI Threat Modeling
OWASP Top 10 · OWASP WSTG · OWASP MASVS · OWASP ASVS · MITRE ATT&CK · PTES · NIST CSF · SANS Top 25 · CVSS · Threat Modeling · Secure SDLC
Public recognitions earned by responsibly disclosing real vulnerabilities in production systems.
Active bug bounty hunter under the handle abhi_hackz.
ASN-based recon grapher — maps an organisation to its ASNs and IP ranges to build attack-surface scope fast. (Shell · recon, asn, asset-discovery)
Go utility that merges, dedupes and hunts through large recon outputs to surface interesting findings quickly. (Go · recon, automation, go)
API endpoint discovery and reconnaissance tool for mapping and testing exposed API surfaces. (Go · api-security, recon, go)
DNS information-gathering automation that wraps dig-style lookups into a fast recon workflow. (Shell · dns, recon, osint)
Subdomain enumeration tool that aggregates multiple sources to discover an organisation’s subdomains. (Shell · subdomains, enumeration, recon)
A graphical network scanner for host and port discovery — point-and-click recon for internal assessments. (Python · network, scanner, python)
What CVE-2026-91140, CVE-2026-92931, CVE-2026-106138 and CVE-2026-106139 are, how each bug class works, how the vendor fixed them and what your team should check. (CVE · 2026-10-14)
The full path from finding a bug in a vendor's product to a CVE record with your name on it — VDP submission, triage, CNA assignment, advisories and what to put in the report. (CVE · 2026-10-13)
Tool-calling agents and MCP integrations turn every document, web page and ticket into an attack surface. Here is how I test them — threat model, payload classes, proof of impact and fixes. (AI · 2026-10-12)
The OWASP API Top 10 hasn't changed, but the apps have. How I test object-level and function-level authorization, property-level exposure and GraphQL in modern APIs. (API · 2026-10-11)
Modern web stacks move logic into frameworks, SDKs and renderers — and so do the vulnerabilities. How to test Next.js-style middleware, server-side fetchers and headless-CMS renderers. (Web · 2026-10-10)
A repeatable Android methodology — static review, dynamic instrumentation, network and storage checks — mapped to OWASP MASVS v2, with the bug classes that keep showing up in fintech and consumer apps. (Mobile · 2026-10-09)
The four-stage recon system behind my bug-bounty and VAPT work — seeding, enumeration, resolution, change detection — and where LLM assistance actually earns its place. (Recon · 2026-10-08)
What changed in bug bounty, why vulnerability disclosure programs are worth your time, how to write reports that survive AI-assisted triage, and the path from first valid report to CVE credit. (Bug Bounty · 2026-10-07)
Campus workshops, boot camps and conference sessions on offensive security and bug bounty.
Abhishek Bhaskar (Abhi HackZ) — Security Analyst & VAPT Engineer. Bug Bounty Hunter · Offensive Security. Based in India · works globally.
Email [email protected] for VAPT engagements, penetration testing, security assessments and bug bounty collaboration, or use the contact page.