Security Engineer (Faking it for now)
Joined August 2021
- Tweets673
- Following287
- Followers129
- Likes356
Chetan Kashyap retweeted
At HackerOne, we benchmarked 18 frontier LLMs against 62 fairly complex vulnerabilities
See which model stands where
(link in the thread)
Chetan Kashyap retweeted
postmessage XSS on reveal.js (72k+ github stars) I reported in Aug (now fixed).
Chetan Kashyap retweeted
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as [email protected], exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/…
Chetan Kashyap retweeted
I earned $50,000 for my submission on @bugcrowd
#ItTakesACrowd
Thanks to @ThisIsDK999 & @_rajesh_ranjan_
Man man just got a crazy bug ! Domain was behind SSO gave few JS to claude and found an endpoint that lets you chat with a chatbot.
Fun part that chatbot can literally invoke every action on their deployment pipeline ⚡️⚡️
Chetan Kashyap retweeted
Going through a tough time. Actively looking for work.
Last 6 months:
→ Merged PRs in @better_auth @appwrite @mintlify @umami_software
→ 150+ GitHub stars, 4K+ npm downloads
→ Shipped 10+ products app
Frontend & Product Engineer. 3+ yrs. Available now.
DM or retweet. 🙏
Chetan Kashyap retweeted
Finding Zero-Days With Any Model
Blog: provos.org/p/finding-zero-da…
Author: Niels Provos
Chetan Kashyap retweeted
Meet Kimi K2.6: Advancing Open-Source Coding
🔹Open-source SOTA on HLE w/ tools (54.0), SWE-Bench Pro (58.6), SWE-bench Multilingual (76.7), BrowseComp (83.2), Toolathlon (50.0), Charxiv w/ python(86.7), Math Vision w/ python (93.2)
What's new:
🔹Long-horizon coding - 4,000+ tool calls, over 12 hours of continuous execution, with generalization across languages (Rust, Go, Python) and tasks (frontend, devops, perf optimization).
🔹Motion-rich frontend - Videos in hero sections, WebGL shaders, GSAP + Framer Motion, Three.js 3D.
🔹Agent Swarms, elevated - 300 parallel sub-agents × 4,000 steps per run (up from K2.5's 100 / 1,500). One prompt, 100+ files.
🔹Proactive Agents - K2.6 model powers OpenClaw, Hermes Agent, etc for 24/7 autonomous ops.
🔹Claw Groups (research preview) - bring your own agents, command your friends', bots & humans in the loop.
-
K2.6 is now live on kimi.com in chat mode and agent mode.
For production-grade coding, pair K2.6 with Kimi Code: kimi.com/code
-
🔗 API: platform.moonshot.ai
🔗 Tech blog: kimi.com/blog/kimi-k2-6
🔗 Weights & code: huggingface.co/moonshotai/Ki…
Chetan Kashyap retweeted
I pointed claude opus at chrome and told it to build a full v8 exploit for discord.
A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell.
hacktron.ai/blog/i-let-claud…
The AI security landscape is no longer a upcoming thing ! It’s happening and trust me it does find some really good issues on open source code if you know how to use it.
Bad thing ? It has significantly increased the number of submissions for triagers to evaluate 😶🌫️
Chetan Kashyap retweeted
This really should have been in the top 10 web hacking techniques of 2025: adragos.ro/fontleak/
Chetan Kashyap retweeted
Sun, sea & cybersecurity. Had a great time with you guys at Nullcon&seasides!
#Nullcon
#CyberSecurity
#InfoSec
#EthicalHacking
#SecurityResearch
#BugBounty
#RedTeam
#BlueTeam
#AppSec
#InfosecCommunity
Chetan Kashyap retweeted
Who’s going to Nullcon this year?
If you’re there, make sure to sign up for @Adobe's live bug-hunting event at Nullcon and earn $$$ uncovering AI vulnerabilities across their next-generation products.
nullcon.net/goa-2026/live-bu…
#NullconGoa2026 #Adobe #AI #hacking
Chetan Kashyap retweeted
We want to thank the hackerone community for an incredible collaboration over the weekend. They discovered a total of 15 unique issues, leading to an expected payout of $750K.
Our eng team has hardened the WAF as issues were discovered, and the last "flag capture" was 20 hours ago as of this writing. By no means is the work done, but we have have jointly achieved substantial protection against React2Shell for Vercel customers.
With that: The focus should remain on patching vulnerable deployments. If you have not patched the time is now! vercel.com/react2shell
We introduced a dedicated HackerOne program for Vercel WAF bypasses for CVE-2025-55182 / react2shell
Critical bypass: $50K
hackerone.com/vercel_platfor…
Chetan Kashyap retweeted
this one is brilliant! you may have seen GIS OAuth during hunting (I have, many times), XSS + ATO. I recommend reading and studying this write-up (author does not have X acc)✌🏻
blog.voorivex.team/not-so-di…
