The cyber work behind CashlessConsumer
Open investigations into India's financial infrastructure: the leaks, exposures and registry blind-spots that institutions — and the people who depend on them — deserve to see. Every scan read-only, every finding disclosed responsibly, no consumer PII ever republished.
.bank.in security audit
The Indian financial namespace, mapped: 4,199 subdomains probed daily for resolution, HTTPS and exposure — plus the IDRBT registry investigation.
Ransomware breach verification
Leak-site claims, independently checked at metadata level. Bank of Baroda (Triple X, 1.07 TB, verified) and Dodo Payments (DireWolf, 60.8 GB claimed, dump pending) — attacker claims vs company statements.
CERT-In · .env exposures
Production .env files served in plain sight on licensed banks' domains — reported to CERT-In and RBI, tracked to remediation.
SharePoint, structurally quiet
On-prem SharePoint's exfiltration gap is a design property, not a CVE: no MFA by default, read = download, estate-wide grants, silence in the logs. Pattern-level — no incident referenced.
eMudhra CA compromise
Eight intermediate certificates from an Indian CA that browsers trust carried private keys a schoolchild could guess. One key was the number 4. The full consumer guide, public statement and open letter to RBI and MeitY.
The invisible UPI library
17 UPI app versions from 2016–2026 dissected to trace NPCI's mandatory Common Library — the PIN pad inside GPay, PhonePe and BHIM. Every signer certificate in the corpus was already expired when shipped. Full evidence kit on GitHub for independent verification.
The FASTag bypass
~100 highway plazas ran shadow software that printed NHAI-identical receipts while pocketing cash from non-FASTag vehicles — while the national system saw almost none of it. A one-man software shop gave contractors an unofficial lane around NHAI's toll system: the definitive DPI-fraud case study.