I build thingsthat break things.
I'm Shantanu— a security assurance lead working across AppSec, DevSecOps, cloud hardening, and AI-driven security automation. This is the map of things I've built, broken, researched, or obsessed over long enough to ship.
Work worth keeping in one place.
- 01Writing2020—
SecurityJunky
Notes from building and breaking secure systems.
My long-running home for technical writing: AppSec, DevSecOps, AI-driven security automation, and hands-on guides across web, mobile, APIs, cloud hardening, and vulnerability research.
BlogAppSecDevSecOpsAIRead the blog - 02Research2025
Chromium VRP
A searchable archive for Chromium VRP reports.
A public archive for Chromium Vulnerability Reward Program submissions: historical reports, dashboard stats, researcher lookups by agent, and JSON endpoints for people who want to query the data directly.
Next.jsPublic APIStaticBrowse reports - 03Tool2025
PolyLens
A sharper workspace for Polymarket traders.
Browser extension plus web app for Polymarket, with advanced filtering, better visual context, and portfolio tracking for people who live inside prediction markets.
Next.jsBrowser Ext.FintechVisit PolyLens - 04Experiment2025
Résumé
A resume site built through an AI-native workflow.
A personal resume site built entirely through v0.dev, with no hand-written code. Part experiment, part proof that AI-native workflows are already good enough to ship useful things.
v0.devVercelNo-codeOpen résumé - 05Creative2024
itsfucking.fun
A portfolio that refuses to behave.
A deliberately chaotic portfolio: interactive demos, hover-driven details, and a loud little reminder that the internet does not always need to look like a quarterly business review.
PortfolioInteractiveVisit - 06Research2025
BeaverTail Malware Analysis
A fake AI recruiter, a malicious repo, and a five-stage payload.
A deep-dive into an attack where threat actors impersonate recruiters and lure developers into cloning a malicious GitHub repo. The writeup follows the chain from JavaScript infostealers to Python RAT deployment, AnyDesk hijacking, credential theft, and persistence.
Malware AnalysisThreat IntelDeriv TechRead on Medium - 07Research2026
QuiloBook Malware Analysis
When a trusted vendor channel becomes the delivery path.
A Deriv security writeup co-authored with Deriv's Head of Security on QuiloBook, a signed Rust loader and RAT campaign delivered through compromised vendor communications. The analysis follows the fake PDF reader, PNG-hidden payload, C2 infrastructure, persistence paths, and defender-ready IOCs.
Malware AnalysisSupply ChainThreat IntelRead on Substack - 08Writing2026
OSWE Certification Journey
What it took to pass OSWE on the first attempt.
A candid account of preparing for and passing the OffSec Web Expert exam: manual source review, web exploitation, no AI assistance, study methodology, HackTheBox machines, CTF prep, exam failures, and the resources built along the way.
OSWEOffSecWeb ExploitationRead on Medium