Adithya Vardhan

Hands-on cybersecurity practitioner with strong expertise in bug bounty, vulnerability assessment, and reconnaissance automation. Participated in private and public bug bounty programs with 30+ valid reports. Skilled in real-world exploitation across web and cloud environments, with live HackerOne submissions. Currently pursuing OSCP at Craw Security. Active CTF participant dedicated to continuous learning in offensive security.

Bug Bounty Researcher - Google

(2025-10 - 2026-01)

Google Vulnerability Reward Program (VRP)

• Identified a publicly accessible S3 bucket (waymo.s3.us-west-1.amazonaws.com) belonging to Waymo with AllUsers: [READ, READ_ACP] permissions, enabling unauthenticated listing of bucket contents.
• Reported the misconfiguration via the Google Bug Hunters portal (Issue #452878192); accepted by the triage team and filed with the Waymo product team for review.
• Engaged in technical clarification distinguishing server-side access control flaws from third-party configuration issues; report reviewed by the VRP panel across three decision cycles.

Bug Bounty Researcher - Salesforce

(2026-02)

Salesforce Product Vulnerability Response (PVR)

• Reported an unauthenticated S3 ListObjectsV2 API endpoint exposing public object enumeration, enabling asset inventory mapping and internal structure discovery.
• Collaborated with Salesforce Security (Case #03675767) to clarify findings; provided supplementary analysis distinguishing enumeration risk from sensitive data exposure.

Bug Bounty Researcher - HackerOne

Private Programs (Netflix, Bumba, Dyson)

• Netflix — LFI on *.nflxvideo.net: Able to access /etc/passwd and other system files. (Informative)
• Bumba — S3 bucket unauthorized file upload via misconfigured endpoint. (Duplicate)
• Dyson — Bypass via internal-use discount code leaking in API response. (Duplicate)
• Reported 30+ vulnerabilities in total, including 5+ duplicates and several informatives across private programs.

Bug Bounty Researcher - Nykaa

(2025-10)

Nykaa Bug Bounty Program

• Identified and responsibly disclosed a security vulnerability; awarded a Certificate of Appreciation (Severity: Low / P4) by the Chief Information Security Officer, Praveen Kumar.
• Certificate ID: d739a280-1148-4f0f-9c75-9ea6cf770881

B.Tech - Digital Technologies Design and Planning (DTDP) - Dr. YSR Architecture and Fine Arts University (2021 - 2025)

Intermediate - Class 12 - Narayana Junior College (2019 - 2021)

10th Standard - Prathibha Model High School (2018 - 2019)