Income Tax portal: any taxpayer's records, one PAN away
Changing one PAN value returned another taxpayer's Aadhaar, bank accounts, and income. More than 135 million registered accounts were in scope until it was fixed.
Read the finding
Viral Vaghela · Senior Security Engineer at Twilio
Breaking things so they hold up.
Security researcher specializing in offensive operations, red teaming, and architecting resilient cloud infrastructure. Converting vulnerabilities into strategic defense assets.
My research, as covered by
Latest research.
Responsibly disclosed findings in government portals, healthcare, and open source, each with a full write-up.
UMANG Portal
Weaknesses across UMANG services exposed EPFO account numbers, LPG bookings, and Aadhaar numbers stored in plain text.
Read the finding
Apollo Hospitals
A public zip file held patient reports, ID documents, source code, and live payment and SMS gateway keys.
Read the finding
Published CVEs
Case study · Income Tax e-Filing Portal
Anatomy of a disclosure.
How one changed value exposed 135 million taxpayers, and how it got fixed.
-
01
Log in as yourself.
Every taxpayer signs in with their own PAN. In the background, the portal loaded your profile by sending that PAN to the server.
-
02
Change one value.
Swap the PAN in that background request for someone else's. No OTP, no second check: just your own session and their PAN.
-
03
The server trusts it.
The server never checked that the PAN belonged to the logged-in user. It returned the other person's name, Aadhaar, bank accounts, and income, for any of 135M+ registered accounts.
-
04
Report, fix, publish.
We reported it to CERT-In and the Income Tax Department in September 2025. It was fixed in early October, and TechCrunch published once it was safe.
How I work.
The same four steps whether the target is a government portal, an npm package, or an LLM agent.
-
Step 1
Map the surface
OSINT and recon to find exposed assets, forgotten endpoints, and the data paths no one is watching.
-
Step 2
Break the assumptions
Manual testing of authorization, logic, and trust boundaries: IDOR, injection, auth bypass, and prompt injection in AI systems.
-
Step 3
Prove the impact
Validate real-world exploitability with a minimal, safe proof, so the risk is clear and the fix gets prioritized.
-
Step 4
Disclose responsibly
Report privately to the vendor, maintainer, or CERT-In, wait for the fix, then publish so others learn from it.
By the numbers.
- 135M+
- Taxpayer accounts protected by a single disclosure.
- 20+
- Critical vulnerabilities reported and fixed.
- 50+
- Hall of Fame acknowledgements from security teams.
- 100K+
- Developers learning security through @Viral_Codes.
About.
I'm a senior security engineer at Twilio, working on product security, offensive testing, and AI/LLM security. Before that I spent almost three years at Zscaler, leading AI red teaming and adversary emulation against critical infrastructure.
I don't just scan for vulnerabilities; I think like an attacker to build defenses that actually hold up. Outside work I create technical content for a community of 100K+ learners at @Viral_Codes, closing the gap between offensive security and the developers building what comes next.
Experience.
-
Twilio
Sep 2026 — Present
Current
Senior Security Engineer
Sep 2026 — Present
Recently joined to work on product security, offensive testing, and AI/LLM security.
-
Zscaler
Jan 2024 — Sep 2026
Bengaluru, India
Senior Security Researcher
Sep 2024 — Sep 2026
- Led AI/LLM red teaming, exploiting prompt injection and adversarial inputs to demonstrate unauthorized data access and unsafe behavior in internal GenAI products.
- Executed adversary-emulated attacks on critical infrastructure and AI-integrated systems, identifying high-risk attack paths and validating real-world exploitability.
- Optimized OSINT workflows to correlate exposed assets and attacker infrastructure, enabling earlier threat detection and better risk assessment.
Security Researcher
Jan — Sep 2024
- Delivered 15+ high-impact risk reports from manual VAPT across web, mobile, API, and infrastructure assets, directly shaping remediation and patch prioritization.
- Simulated real-world attack scenarios against high-value assets to validate exploitability and security risk.
-
Independent
2022 — Present
Bug Bounty Hunter
Recognized by 50+ organizations for responsible disclosure of critical flaws, focused on cloud authentication bypasses, API logic flaws, and distributed-systems vulnerabilities.
-
Finlegal
Sep — Dec 2022
Remote
Security Engineering Intern
- Identified critical vulnerabilities (IDOR, code injection) across web, mobile, and APIs, and drove cross-functional remediation.
- Ran end-to-end VAPT and security assessments to harden application architecture and reduce attack surface.
Recognition.
Security teams that have acknowledged my reports, and the agencies I've coordinated disclosures with.
Hall of Fame
Acknowledged by 50+ organizations, including:
- Cambridge
- Vodafone
- Airtel
- Groww
- Shaadi.com
Coordinated disclosure
Government findings reported through:
- CERT-In
- NCIIPC
- MeitY
- Income Tax Dept.
Projects.
Open-source tools for OSINT, reversing, and network monitoring.
-
Dart · OSINT
Flutter Insta
A Dart package for gathering Instagram account data: profile details, image URLs, and metadata, without scrapers or official API keys.
-
Flutter · Law enforcement
CyberCop
An OSINT mobile app for police and cyber-crime investigators: geolocation tracking via short URLs, device forensics, and vehicle and IMEI lookups.
Google Play ↗ 1,000+ downloads
-
Python · Reversing
Secret Finder
Detects hard-coded API keys, tokens, and PII in Android APKs using pattern matching and entropy analysis.
Source ↗ Used by 100+ researchers
-
Python · Threat intel
Netguard
Monitors outgoing traffic and checks destination IPs against VirusTotal threat intelligence in real time.
Writing.
Write-ups on web exploitation, Android security, and red-team tradecraft.
-
Web security · XSS
15 Creative & Advanced XSS Exploits
Sophisticated cross-site scripting techniques that bypass modern filters and security headers.
-
Android · ADB
ADB & Android Multi-user
The security implications of Android's multi-user feature when accessed over ADB, and where data can leak.
-
Red team · OSINT
Exploiting Personal Setups
How individual developer environments become a pivot point into enterprise infrastructure.
Skills.
- AI/LLM security
- Prompt injection, jailbreaking, adversarial attacks, model poisoning, OWASP Top 10 for LLMs, MITRE ATLAS
- Security research
- VAPT (web, API, mobile), code review (SCA, SAST, DAST), IDOR, RCE, logic flaws, reverse engineering (JADX), OSINT
- Security tools
- Burp Suite Pro, Nuclei, SQLMap, OWASP ZAP, Postman, MobSF, Frida, Metasploit, Wireshark, Nmap, Git
- Cloud & infrastructure
- AWS, Azure, GCP, Docker, GitHub Actions
- Programming
- Python, Node.js, JavaScript, PHP, Java, Dart, Go, C/C++
- Threat modeling
- MITRE ATT&CK, enterprise security architecture, zero-trust defense
- Environment
- Kali Linux, custom Zsh, WSL2
- Hardware Learning
- RF and hardware attack vectors: Flipper Zero, Proxmark3, Raspberry Pi 5, Rubber Ducky
Found something? Let's talk.
Red teaming, AI security, a disclosure you need help with, or the latest zero-day. Email is the fastest way to reach me.