09/25/2026 updated
100 % available
AppSec Engineer & Full-Stack SaaS Developer | Web/API Pentesting, Secure Code Review, DevSecOps
gurugram, India
Only remote
Information Technology coursework, IIIT Allahabad (degree not completed)About me
Independent AppSec engineer and full-stack SaaS developer from India. I build web products end to end and make them secure, from pentesting and code review to CI/CD security gates. Remote-first, clear communication, and actionable, developer-friendly results.
JavaScriptApplication Programming Interfaces (APIs)Penetration TestingApplication SecuritySoftware as a ServiceCode ReviewWeb DevelopmentPython (Programming Language)Vulnerability ScanningOAuthOWASPWeb Application SecuritySoftware SecurityBackendWeb Frameworks
Application Security Engineer and vulnerability researcher focused on finding and fixing security flaws in web applications, APIs and CI/CD pipelines. I also build full-stack web applications and SaaS products end to end, so I understand both how systems are built and how they break.
Core skills:
- Web application penetration testing (OWASP Top 10, business logic flaws, IDOR/access control, SSRF, XSS, SQLi, CSRF)
- API security testing (REST, GraphQL, OWASP API Top 10, authentication and authorization testing)
- Authentication security: JWT, OAuth 2.0 / OpenID Connect, session management, SSO integrations
- Secure code review (manual + SAST) for Python, JavaScript/Node.js and web frameworks
- DevSecOps: security gates in CI/CD (GitHub Actions), SAST/DAST/SCA integration, secrets scanning
- Reconnaissance and attack surface mapping: subdomain enumeration, DNS takeover checks, JS endpoint discovery
- Browser security headers and Content Security Policy (CSP) hardening
- Clear reporting: reproducible PoCs, risk ratings and developer-friendly remediation guidance
Tools: Burp Suite Pro, OWASP ZAP, Nuclei, subfinder, ffuf, Semgrep, Postman, Git, Docker, Linux, Python
Experience highlights:
- Security internship at Accenture
- Independent bug bounty researcher on HackerOne since 2024 (programs incl. Spotify, Kiwi, Lightspark)
- Research: benchmarking LLMs vs SAST tools on JWT vulnerability detection (252-sample AST-verified dataset, 9-class taxonomy)
- Built subsense: subdomain enumeration and DNS security tool (takeover, AXFR, zone walking, Nuclei integration, JSON/HTML reports)
- Built a policy-driven DevSecOps CI security gate, an LLM-backed Burp Suite extension and JSFinder recon tool
- Built and run ParakhWork (parakhwork.com), a jobs and recruiter platform
Portfolio: github.com/harshitp1971
Full-stack & SaaS development:
- End-to-end web application and SaaS development (frontend, backend, REST APIs, databases, authentication)
- Multi-app SaaS platforms with separate candidate, recruiter and account portals (ParakhWork)
- Secure-by-design builds: auth, role-based access control, input validation and security headers from day one
- Deployment, CI/CD and cloud hosting
Experience
Professional experience0 - 5 years
Freelancer since2024
Languages
EnglishGoodHindiNative speaker
Project history
Designed, built and run ParakhWork, a multi-app jobs and hiring SaaS platform:
- Candidate job portal with AI-matched and verified job listings (aijob.parakhwork.com)
- Recruiter platform for posting jobs and managing candidates (hire.parakhwork.com)
- Central account and authentication service (account.parakhwork.com)
- Full-stack development end to end: frontend, backend APIs, database, auth and deployment
- Security built in from day one: access control, input validation, secure session handling and security headers
Independent vulnerability research on public bug bounty programs (incl. Spotify, Kiwi, Lightspark):
- Black-box testing of web apps and APIs for access control, authentication and business logic flaws
- Recon and attack surface mapping with custom tools (subsense, JSFinder)
- Writing clear reports with reproducible PoCs and remediation advice