Ajmal M S — software engineer and cybersecurity engineer. I build secure, scalable products end to end, and I test them the way attackers do: web, mobile and API pentesting, Active Directory and red team operations. Freelancing across both since 2019.
Software engineer · Penetration tester · Red team analyst
I’m Ajmal M S — a software engineer and cybersecurity engineer. I design and build secure, full-stack products, and I test systems the way attackers do — web, mobile, API and Active Directory. Delivering both for clients since 2019.
CRTA · CNSP · CCEP · NASA VDP Hall of Fame
↗eBPF runtime sensor · Rust
NASA VDP
Hall of Fame
Building SentriUI — a security-first React UI kit
Security tools, AI products and platforms — from kernel sensors to client SaaS.
Client platforms and products from freelance and professional work. github.com/AjmalX0
Turborepo monorepo: website, four role dashboards, NestJS ledger/payments API and an Expo app sharing Zod contracts; EOI → reservation → sales flows, KYC and RLS.
Next.js 15 · NestJS 10 · Kysely · Supabase · ExpoAdmin/instructor/student roles, JWT access + refresh in HttpOnly cookies, YouTube lessons with watch-time tracking, real-time chat and Q&A.
Next.js 14 · NestJS · Prisma · Redis · Socket.IOMulti-agent WhatsApp inbox: contacts, segments, approved templates, media, delivery webhooks and cron follow-ups; campaign & analytics CRM.
Node.js · WhatsApp Cloud API · React · TanStack QueryAI therapy chat, mood and activity tracking with progress analytics, and event-driven background analysis behind JWT-secured APIs.
Next.js · Express · MongoDB · Gemini · LangChain · InngestSecurity-first React UI framework: sanitised forms, DOM-clobbering protection, CSRF, RBAC dashboard, MFA kit and an XSS/JWT/CSRF playground.
React · TypeScript · DOMPurify · ZodSoftware for clients — web platforms, admin dashboards, mobile apps, WhatsApp bots and CRM automation — plus cybersecurity engagements: web, mobile and API penetration tests, vulnerability assessments, and remediation with re-testing.
Real-estate · healthcare · education · retail · servicesBreaking and building — the full stack, from kernel to UI. Scroll to turn the ring.
Web, mobile, API and infrastructure pentesting, Active Directory attack paths, Kerberos abuse, pivoting and post-exploitation mapped to MITRE ATT&CK.
Secure code review, threat modelling and CVSS-rated reporting — plus detection engineering, log triage and forensics.
Secure REST APIs, auth flows, real-time services, background jobs and messaging integrations.
App Router and RSC front-ends, state management, motion and WebGL — plus React Native and Flutter apps.
Relational, document and graph data with RLS — and AI features from face recognition to LLM agents.
Systems programming and scripting, plus the servers underneath: Linux hardening, reverse proxies, containers, monitoring and CI/CD.
Hands-on pentesting of web and mobile applications, freelance VAPT since 2019 and red team certification — plus the research write-ups I share on my blog. Always in scope, always with permission.
Methodology
Scope, asset discovery, fingerprinting and OSINT.
PTESTrust boundaries, data flows and abuse cases.
STRIDEManual + automated testing of web, mobile, API and infra.
OWASP Top 10 · API Top 10Prove impact; AD attack paths and lateral movement.
MITRE ATT&CKReproducible steps, CVSS ratings, code-level fixes.
CVSSVerify every patch with developers.
Re-test & closeAssessment coverage
SQLi, XSS, broken auth, business logic — OWASP Top 10
Local storage, traffic interception, auth flows and backend API abuse
Auth bypass, JWT forgery, rate-limit abuse, parameter tampering
Kerberoasting, AS-REP roasting, PtH/PtT, pivoting (Ligolo-ng, Chisel)
Misconfigurations, access control, data handling
Code-level remediation from years of full-stack work
eBPF, Splunk, Wazuh, Sysmon, Volatility, Autopsy
Research write-ups · from my blog
Unsafe deserialization in the Flight protocol hangs Next.js servers; affected versions, the incomplete first fix and mitigations.
Read analysis ↗URL-fetch feature → instance metadata → temporary IAM credentials.
Read write-up ↗Missing state, loose redirect URIs and email-based account linking.
Read write-up ↗Object IDs without ownership checks; OWASP API1:2023.
Read write-up ↗Algorithm confusion, kid injection and crackable HMAC secrets.
Read write-up ↗pull_request_target, script injection and mutable action tags.
Read write-up ↗Certifications
CyberWarFare Labs · Jan 2026 · 6-hour practical: AD, Kerberos, pivoting, ATT&CK
ID 695a712c350a0624a438152eThe SecOps Group · Nov 2025
ID 10776026Red Team Leaders · Nov 2025
Recognition
via Bugcrowd · 2026
Senior category · Top 10 of 500+ teams (local event)
All 24 challenges of Advent of Cyber 2025
Team 3NDP01NT · 2nd on server · 17,866 pts
Testing is performed only with explicit authorisation. Client work is confidential — write-ups are independent research shared on my blog.
Seven years of client work on both sides. Software: end-to-end web platforms, admin dashboards, mobile apps, WhatsApp bots and CRM automation for real-estate, healthcare, education and retail businesses. Security: web, mobile and API penetration tests, vulnerability assessments and configuration reviews, with remediation guidance and re-testing.
Penetration testing of both web and mobile applications and the APIs behind them, against the OWASP Top 10 and API Top 10: SQLi, XSS, broken authentication, JWT forgery, rate-limit abuse and parameter tampering. Wrote CVSS-rated reports, re-tested every fix with developers, reviewed cloud configurations and access control, and triaged logs.
Built and maintained client applications with Django, React, Next.js and the MERN stack: secure REST APIs, authentication flows and business logic on PostgreSQL, MongoDB and MySQL, reusable components, performance work and third-party integrations.
Design Capture-The-Flag events for colleges (web exploitation, cryptography, forensics, OSINT and reverse engineering) plus the platform and infrastructure that host them.
Led technical activities for the 2025–26 term, ran online and offline security sessions and hands-on workshops, and mentored students in ethical hacking and CTFs; Vice Chair since Jul 2026.
Built and maintained plugin-based WhatsApp bots and Telegram / Instagram downloader bots with multi-device sessions, media processing and one-click Heroku and Docker deploys.
Expected 2028. Finance Lead at IEDC (Jan 2026 – present); speaker at SKILLFORGE 2.0 (ISTE SC RIT); mentor at the Tech Thrive 2.0 hackathon (RIT Kottayam).
Long-form write-ups on security and engineering. All posts
Reporting a vulnerability?
Encrypt it with my PGP key. Check the fingerprint matches before you send — it proves the key is really mine.