tech_utsav --list-projects
What I've built (and broken)
// Built for Tech Utsav, Tietoevry's company-wide innovation challenge held every six months — self-initiated and self-built, then shared publicly as open security research.
Fruit-Store-Pentest
- Designed and built a complete Flask e-commerce application, then independently introduced and exploited 13 real vulnerability instances spanning 10+ OWASP Top 10 categories — SQL injection, stored/reflected XSS, IDOR, CSRF, SSRF, broken access control, insecure file upload, and weak password hashing.
- Chained a mass-assignment privilege-escalation flaw with an admin-only SSRF endpoint to demonstrate a full multi-step compromise path from a low-privilege account, mirroring a real-world attack chain.
- Remediated every finding on a parallel patched branch and documented root cause, proof-of-concept, CWE classification, and fix for each vulnerability.
FlaskSQLiXSSIDORCSRFSSRF
Sensitive-Data-Guard
- Built a Chrome extension and FastAPI backend that detects sensitive-data disclosure in real time across web forms and chat platforms (WhatsApp Web, LinkedIn messaging), using a hybrid rule-based and machine-learning pipeline.
- Trained and iterated TF-IDF + Logistic Regression classifiers across 15 rounds of dataset and model refinement, reaching up to 98.5% precision / 98.5% recall on a locked regression-test set.
- Integrated Google Safe Browsing and AbuseIPDB threat-intelligence APIs to assess site and IP reputation before flagging sensitive input.
- Applied a disciplined evaluation methodology — deduplicated datasets, frozen real-world test sets, and hard-negative tracking — to prevent data leakage and overstated accuracy claims.
Chrome ExtensionFastAPIscikit-learnTF-IDF
NOC Auto-Responder
- Built a Python automation tool that monitors a NOC mailbox over IMAP, parses device-down alerts, resolves the affected site's manager contacts and location, and enriches each incident with live weather data.
- Integrated Google Gemini to draft professional incident notifications, with a guaranteed deterministic template fallback so a notification is never lost to an AI failure.
- Implemented per-incident error isolation and full audit logging (delivery status, Gemini vs. fallback usage) across the pipeline.
PythonIMAPGemini APIAutomation