Replies within one working day
Book a callDon't take my word for it.
Everything on this page is public. What's missing from it is at the bottom, with the reason.
run the tools · read the report · verify the certifications · see the Lab
Nothing here asks you to take my word for it.
Plus free templates — a rules-of-engagement document and a mutual NDA, both used in my own engagements — and a live self-scan: amansploit.com continuously reports its own security posture. So does this site.
- 01
Eight free security tools ↗
Email spoofability, DNS hygiene, TLS, headers, CT attack surface, JWT decoder, CVSS, hash identifier. Run them on your own domain.
amansploit.com/tools
- 02
Shield — the case study
Free, open-source: verified case pages, hashed evidence packs with chain of custody, generated complaint drafts for impersonation victims in India. My own product; the case study says what was decided and why.
amansploit.com/shield · case study on this site
- 03
A 12-page sample pentest report ↗
Against a fictional target, in the exact format you'd receive. Read it before you hire anyone, including me.
amansploit.com/sample-penetration-test-report.pdf
Three things, counted.
Shield, the SOC-Ready Detection Pack and the AI-assisted incident response research. Numbers appear here only once they can be checked; the rest is linked.
shield
3outputs per case in Shield, the free, open-source, WhatsApp-first impersonation response tool
soc-ready detection pack
ai-assisted incident response
Three things built, one of them in production.
The work is described, not the letterhead — what I did, in what, and what changed.
- 01
ACS FRAT — aviation flight-risk assessment platform
I designed the access-control model, moved all risk scoring to the server so a user can't alter their own assessment, ran a repo-wide secret audit across the full git history, and added Gitleaks to CI. Next.js, TypeScript, Supabase.
role: security and product lead · in production
- 02
A SIEM log-source monitor
Built as a security analyst, Jun–Aug 2026. A Python platform that verified, every hour and per client, that logs were actually arriving from every source feeding a SIEM. Dead feeds had taken days to notice; this cut it to under an hour. In its first pilot it caught a real Domain Controller outage nothing else had flagged.
built for a Pune security operations team · role: designed and built, as the team's analyst
- 03
dwcollector — a self-hosted dark-web exposure monitor
An asynchronous Python crawler over a containerised Tor proxy; simhash clone detection with union-find clustering so the same leak on ten mirrors is one alert; a PGP-anchored trust model for sources; validating PII detectors so an email or a card number has to actually be one before it fires.
role: designed, built and maintained · own project
- 04
Six months of VAPT — Jul 2025 to Jan 2026, InLighnX Global
Web, API, mobile, thick-client and infrastructure testing against real client systems. Findings included IDOR, authentication and session flaws, XSS, injection and CORS misconfiguration. Wrote the client-facing reports.
role: penetration tester, employed
Three real ones, with the client filed off.
The defect, the line that gives it away, and what changed — with the identifying details removed. The interesting part is how ordinary they are.
- 01
Every invoice was one number away
Pre-launch review · B2B billing portal. Any logged-in customer could read every invoice on the platform: the id was sequential and the server never checked who was asking. The fix: one authorisation check at the data layer — invoice.ownerId === session.userId — and ids moved to non-guessable values. Two files.
day one: High (CVSS 7.5) · after the fix: closed, retested
- 02
A password reset that reset anyone's
Build + pentest · scheduling SaaS. A single valid reset token could take over any account, including admins: the token was validated but never tied to the email it was issued for. The fix: bind the token to its account, expire it on use, rate-limit the endpoint. Caught in the final-week attack, never shipped.
day one: Critical (CVSS 9.1) · after the fix: closed, nobody was ever exposed
- 03
The site graded itself, and failed
Pre-launch review · public marketing site + app. Missing every response-header defence, and the domain was freely spoofable in email. The fix: a strict Content-Security-Policy with nonces, HSTS with preload, a frame policy and the three hygiene headers — plus SPF and DMARC records. The same set this site scores A on.
day one: F · after the fix: A · Medium severity, but the first thing a buyer or attacker checks
credentials — all earned, all verifiable
- 4
certifications, all verifiable with the issuer
- 1%
top of TryHackMe, globally
- 6
months of VAPT against real client systems
- 6
of 6 security headers on this site, live
Certifications: CEH Master · CompTIA Security+ · Certified Network Defender (CND) · ECSS. All EC-Council or CompTIA; each can be verified with the issuer on request. Education: B.Sc. (Hons) Cybersecurity, Coventry University, 2021–2025; M.Sc. Cyber Security, EC-Council University — in progress, not yet conferred. Writing: five articles at amansploit.com, on domain spoofing, what a pentest report should contain, pentests versus scans, preparing for a first pentest, and how the lab site was built.
I'd rather leave the space empty.
Three things, each said once. Everything above is what there is instead.
- 01
Client names
The clients I've built for since August 2026 haven't given permission to be named, and I won't ask you to trust a claim you can't check.
- 02
Testimonials and reference calls
None yet; I'd rather leave the space empty than write “coming soon”.
- 03
Years in business
Alythen has existed since August 2026. What existed before that is everything above.
Judge it on what's checkable.
A set of tools anyone can run, an open-source project people are using, a production platform I secured, a report format you can read before you pay for it, and four certifications you can verify — every one of them public, none of them asking for trust.
Run the tools first if you like.
Then tell me what you're building. The Lab on this site shows the same craft live.