Lokanath Pradhan
Cybersecurity professional with hands-on experience in web application & network vulnerability assessment, bug bounty research, and security tool development. 50+ vulnerability reports submitted across HackenProof, HackerOne, Bugcrowd, immunefi (Web3), and direct disclosures — with bounty-paid and resolved findings at Max Healthcare, Perfios, TATA Motors, HDFC Life, Synology, Adidas, and Hero MotoCorp. Critical-severity Web3 finding on Berachain. Proficient in Python, Go, JavaScript, and Shell scripting.
Languages
Frameworks
Security Tools
Cybersecurity
Dev & Cloud
Vuln Classes
- 50+ vulnerability reports across 6+ platforms; findings include Bounty-Paid, Resolved, and In-Review statuses across public and private programs.
- Com Olho — Bounty-paid: Perfios P4 (Unauthenticated PII Exposure), Max Healthcare P2 (Session Cookie Server-Side Exceptions). 38 reports total across Allcargo, TATA Motors, HDFC Life, Zerodha, Orient Electric and more.
- HackerOne — Reports at LinkedIn (Business Logic / Rate Limit Bypass, High), 8x8 (Host Header Injection / Cache Poisoning, Medium), Remitly, Deribit, Status (CVE-2025-59474).
- immunefi (Web3) — Critical finding on Berachain: Public RPC leaks live Mempool data via txpool_content, enabling frontrunning attacks (#50274).
- Direct Disclosure — SSRF + OAuth PII leakage (Adidas); Nginx Config Disclosure (Hero MotoCorp, acknowledged); CORS Misconfiguration CDN credential leakage, High (Synology).
- Bugcrowd — Directory Listing (Monash University), Prometheus Node Exporter on 26 production hosts (Opera), AWS Access Key Exposure, DNS Rebinding (Ibotta).
- Contributed to Python automation scripts during a 1-month internship.
- Gained practical exposure to real-world software engineering and development workflows.
Completed TryHackMe paths:
Externally issued and verifiable certifications. TryHackMe learning paths are tracked separately under CTF & Security Labs.
Institution names and grade details are available in my full résumé — get in touch to request it.