Nisarga Adhikary

19 · he/him/they

Security, OSINT & Threat Intelligence Engineer C3iHub Indian Institute of Technology, Kanpur Kanpur - 208 016, UP, India. nisarga[at]cse.iitk.ac.in hello[at]ni5arga.com

Work

I'm a Security, OSINT & Threat Intelligence Engineer at C3iHub, the cybersecurity technology innovation hub at IIT Kanpur. The director of IIT Kanpur, Dr. Manindra Agrawal, reached out after reading my CBSE writeup and hired me, and called me "a talented young engineer with significant potential". I don't have a college degree.

Mostly:

• Red Teaming & Adversary Simulation
• AI Security
• Threat Intelligence
• OSINT

I got online early and started taking things apart about as soon as I could. Everything I know is self-taught. Before C3iHub:

• Engineering at an Antler-funded startup
• Engineering at a Singapore-based cryptocurrency company ($4–6M valuation)
• Founding engineer at an early-stage startup
• Web development for a non-profit
• Open source maintainer at a non-profit

Otherwise

I'm autistic and I have ADHD, both diagnosed. I used to think they were things to work around. Now I think they're probably the reason I can do most of what I do. The CBSE portal took twenty minutes to break and three months to stop thinking about. My brain has never been very good at letting things go. This applies to people too.

I grew up believing that being exceptional was the safest way to be loved. Rank, work, whatever came next. I got good at collecting things that look impressive written down. None of them made the lonelier years much less lonely. There is something strange about being praised for how far you're going while quietly wishing someone would ask you to stay.

I watch too much anime and listen to Radiohead, Weezer, Clairo, TV Girl and Mitski. Somewhere between Creep, I Bet on Losing Dogs, and relating to Shinji from Neon Genesis Evangelion more than is advisable is probably most of me. Some songs still belong to people I don't speak to anymore. I let them.

I'm queer. I care about privacy, human rights and digital rights. Maybe there's something personal in that: I think everyone deserves to be understood without having to surrender every part of themselves.

I think every line of code ever written is political. GNU/Linux is the obvious case — the licence is the argument, and it exists because someone decided that who owns your software is a question about freedom, not convenience.

I've mistaken kindness for love and love for permanence. I've held on too long and said the right things too late. Somehow, none of it made me cynical.

I still think there is nothing more intimate than being remembered in small ways: a song saved for you, the seat beside someone, an insignificant detail kept for no reason other than that it was yours.

Maybe love is just attention, given gently.

Disclosures

Between May and August 2026 I sent 60+ vulnerability reports to CERT-In. They cover critical government portals, dating apps with user bases in the millions, funded startups and companies valued in the billions. Some of my public writeups are linked below.

• CBSE On-Screen Marking Portal
  Hardcoded master password in the frontend JS bundle, client-side OTP validation, unguarded Angular routes, a password-reset endpoint that never checked the current password, systemic IDOR, SQL injection leading to xp_cmdshell and RCE, and a public S3 bucket enumerating 2026 answer sheets and question papers. Examiner account takeover and mark alteration were possible on the system evaluating Class 12 boards across 28,000+ affiliated schools.
  Reported to CERT-In 25 Feb 2026 (CERTIn-16590126). Published 22 May 2026 after three months without resolution. Acknowledged and fixed 31 May 2026.
• Café Coffee Day
  Publicly readable S3 bucket, unauthenticated sequential invoice enumeration, BOLA leaking customer phone numbers, and an unthrottled 5-digit OTP with no lockout — together, unauthenticated mass account takeover requiring no prior knowledge of any target.
  Reported to CERT-In 8 Jul 2026 (CERTIn-51351626). Verified patched 18 Jul 2026.
• FOSS United
  Six issues: IDOR on hackathon project PRs and issues, broken access control allowing registration by impersonation, resource exhaustion via ast.literal_eval, unauthorised project creation, unauthenticated ticket-transfer modification, and missing authorisation checks across several endpoints.
  Published 2 Feb 2026.

Other

• Winner, FOSS Hack '26
• EF SET C2 (Proficient) — equivalent to IELTS 8.0–9.0
• Global Rank 17 (57/60), British Council International English Olympiad, 2022

Press

• BBC — "Teen exposes critical vulnerabilities in India's national CBSE exam portal"
• Bloomberg — "India Teens Expose CBSE Exam Flaws, Trigger Political Showdown With Modi"
• The Hindu — interview on the OnMark portal vulnerabilities
• India Today — "CBSE OSM portal vulnerability claims surface with teen's detailed blog post"
• Times of India — "CBSE faces fresh scrutiny after teen researcher alleges critical flaws in OSM portal"
• Bloomberg — "Indian Exam Board Fixes Cybersecurity Flaws Found by Teen"
• NDTV — "IIT Kanpur director calls Nisarga Adhikary a talented young engineer with significant potential"
• Business Standard — "How a 19-year-old exposed flaws in CBSE's On-Screen Marking portal"
• Deccan Herald — "After exposing CBSE OSM portal flaws, 19-year-old joins IIT Kanpur's cybersecurity team"
• The Federal — "IIT Kanpur hires cybersecurity researcher after CBSE-OSM row"
• IANS — "Found CBSE portal vulnerabilities in 20 minutes, not afraid of FIR"

On the C3iHub appointment:

• The Print — "Nisarga Adhikary, ethical hacker who hacked CBSE, hired by IIT Kanpur"
• The Ken — "RBI's pipeline for hackers now starts at IIT Kanpur. It isn't where they want to end up"
• Zee News — "Days after exposing CBSE OSM flaws, 19-year-old joins IIT Kanpur's cybersecurity hub"
• Free Press Journal — "19-year-old ethical hacker joins IIT Kanpur's cybersecurity hub"
• India.com — "19-year-old who exposed flaws in CBSE's OSM portal gets hired by IIT Kanpur C3iHub"
• Full List — at ni5arga.com/press

Listening to

Elsewhere

• Blog (ni5arga.com/blog)
• Website (ni5arga.com)
• GitHub
• X/Twitter
• Press
• Resume/CV (PDF)

Colophon

This website is one index.html file that I wrote by hand in a text editor. No framework, no build step, no static site generator, no package manager, no dependencies. The CSS lives in a <style> tag in the head. There isn't even a webfont. Whatever serif you're looking at right now is whatever your browser decided a serif should look like. I like that.

There are zero <script> tags. The only JavaScript running here belongs to Spotify inside its iframe, which is also the only third-party request this page makes. Every image lives on this server, including all fourteen 88×31 buttons. I copied them instead of hotlinking them because making somebody else's server deliver a 4 KB GIF every time you visit my homepage feels vaguely impolite.

• index.html — 18,511 bytes
• photograph — 82,914 bytes (JPEG, 560×560)
• fourteen tiny buttons I care about too much — 55,027 bytes
• two favicons — 1,512 bytes
• the entire website — 157,964 bytes
• 36 outbound links, 15 images, 1 iframe, 0 scripts

It lives at /homepages/global/nisarga/ on turing.cse.iitk.ac.in and gets deployed with scp over SSH. There is also a ~/public_html on this account that looks exactly like the place a personal homepage should go. Nothing reads it. I found this out only after putting the website there and wondering why absolutely nothing happened. As far as I can tell it exists primarily to lie to me.

I think websites should be allowed to be this minimal.

Hand-written HTML. Hosted at CSE, IIT Kanpur.