Harshit Arora, product security engineer

I test web apps and APIs for business-logic flaws, then build the CI/CD checks that keep the same bugs out of production. Founding security engineer at ETM, Bengaluru.

Email me

115+ hardcoded secrets removed and 39 repositories put under SAST at ShopBack.

harshit@sec ~ zshtype help

~ $ whoami

Harshit Ramesh Arora

Product security engineer, vulnerability researcher

Bengaluru, India

~ $ cat now.txt

Co-founder and founding security engineer at ETM

Bug bounty on HackerOne, Bugcrowd and Intigriti

Try:

Flint, my project that finds your leaked data and keys

It scans public sources for your leaked data and keys, adds alerts from a scanner on your own machine, and puts all of it in one triage view. Visit my GitHub

Flint / Exposures

GHPublic repoCloud access key in config.jsNeeds you3m
PSPaste siteEmail and password pairOpen40m
LPThis laptop.env file with live tokensOpen1h
BRBreach dumpPhone number and emailOpen2h
GHPublic gistDatabase URL with passwordRotated1d
LPThis laptopSSH key in DownloadsRotated1d
GHPublic repoChat webhook URLRotated2d
PSPaste siteHome addressWatching3d
LPThis laptopBrowser export of loginsRemoved4d
BRBreach dumpOld work emailWatching6d

public repo src/config.js +2+3−2−3

@@ -8,12 +8,12 @@ export const cloud = {

88import { env } from "./env.js";

1010export const cloud = {

11 region: "ap-south-1",

11 region: env.CLOUD_REGION,

1212 accessKey: "AKIA••••••7Q2D",

12 accessKey: env.CLOUD_ACCESS_KEY,

FL Flint 3m Applied

Live key in a public commit. Rotate it, then read it from env.

13 secretKey: "••••••••••••",

13 secretKey: env.CLOUD_SECRET_KEY,

1414 bucket: "uploads",

1515};

1616

1717export function client() {

1818 return connect(cloud);

1919}

2020

2121export const uploads = {

2222 maxSize: 10 * 1024 * 1024,

2323 types: "png, jpg, pdf",

2424};

2525

2626export default cloud;

Security experience at ETM, ShopBack and CyRAACS. From CI pipelines to client pentests.

Runs security scanners on every push

ETM, since August 2026. I co-founded the company, built its site and set up GitHub CI to scan each change.

etm/site/main #212 1m 25s Running

HA Scan every change 9c1e4a7

Checkoutgit fetch4s
SASTcode scan41s
Secretssecret scan40s
Builddocker buildQueued
DeployreleaseQueued

$git fetch --depth 1 origin main HEAD is now at 9c1e4a7 $code scan on 214 files 0 high, 0 critical $secret scan on the diff no new secrets $docker build -t site:9c1e4a7 . $release site:9c1e4a7 live, health check passed

Put 39 repositories under SAST

ShopBack, June to December 2025. The scans caught 2 critical issues, fixed before they reached production.

Security checks

4 of 4 on

AI-assisted SAST39 repositories
OWASP secure-coding checksPart of the SDLC
Weekly secret scansEvery repository
Upwind CNAPP in GitLab CI/CDCloud workloads, no slower deploys

Removed 115+ hardcoded secrets

ShopBack. CommitCat Manager, the tool I built, tracks secret findings from every repository in one place.

Secret cleanup

3 of 5

Scan every repository
Track findings in one place
Test which old keys still work
Rotate and remove 115+ secrets
Scan again every week

Tested client web apps and APIs

CyRAACS, August 2024 to February 2025. Found 3+ CVEs and 10+ OWASP Top 10 issues for enterprise clients.

CERT-In report sentnowWeb and API test for a client
Fixes verified2dTime to remediate down 30%
CVE reported1wFound on a client pentest

Break it.
Prove it.
Fix it.

I report what I can show working, then stay with the team until it is fixed. Bug bounty since January 2026, mostly business-logic flaws and DNS or MX takeovers.

HackerOne
Bugcrowd
Intigriti

Security research from CTFs and bug bounty. Small bugs, joined into big ones.

Chains file inclusion into code execution

CloudSEK CTF 2026 and FamPay CTF: a local file inclusion became remote code execution through PHAR deserialization.

Pulls credentials from heap dumps

An exposed Spring Boot actuator served a heap dump, and the credentials were inside it.

password Ctrl K

heapdump.hprof

datasource.passwordstring
admin.passwordstring
mail.smtp.passwordstring

↑↓ to moveEnter to open

Walks a five-step SSRF chain

Built on CVE-2020-13379 in Grafana, five requests deep into the internal network.

Inverts leaked embeddings

After the event I solved a vector-database challenge with vec2text and wrote it up on Medium.

vec2text

Ready

Vector DB challenge

Which text made this embedding?

Inverted it back to the original sentence, from the vector alone. Write-up on Medium

Paste a vector

JSner pulls hidden API routes out of JavaScript

A recon tool in JavaScript and Python. It crawls a target’s JS files and lists endpoints, undocumented API routes and sensitive config paths.

Parses everything on your own machine
Removes duplicates before it reports
Exports to JSON or TXT

Visit my GitHub

recon/jsner zsh local

~/recon/jsner$jsner target.test

4 of 4 bundles

main.js14 routes212ms

vendor.js3 routes488ms

admin.chunk.js9 routes174ms

config.chunk.js2 paths96ms

Found28 endpoints(41 raw)

Savedjsner.txt(local)

Donein 0.97s

~/recon/jsner$

TXTjsner.txt { }jsner.json 28 routes

GET  /api/users/:id/export    main.js
POST /api/internal/refund     main.js
PUT  /api/admin/flags         admin.js
GET  /api/v2/orders/:id       main.js
CFG  /config.staging.json     config.js
GET  /api/health              vendor.js