Adithya Vardhan
Hands-on cybersecurity practitioner with strong expertise in bug bounty, vulnerability assessment, and reconnaissance automation
Hire this person
Send a job offer directly to this candidate
About
Hands-on cybersecurity practitioner with strong expertise in bug bounty, vulnerability assessment, and reconnaissance automation. Participated in private and public bug bounty programs with 30+ valid reports. Skilled in real-world exploitation across web and cloud environments, with live HackerOne submissions. Currently pursuing OSCP at Craw Security. Active CTF participant dedicated to continuous learning in offensive security.
Experience
Bug Bounty Researcher - Google
(2025-10 - 2026-01)
Google Vulnerability Reward Program (VRP)
- Identified a publicly accessible S3 bucket (waymo.s3.us-west-1.amazonaws.com) belonging to Waymo with AllUsers: [READ, READ_ACP] permissions, enabling unauthenticated listing of bucket contents.
- Reported the misconfiguration via the Google Bug Hunters portal (Issue #452878192); accepted by the triage team and filed with the Waymo product team for review.
- Engaged in technical clarification distinguishing server-side access control flaws from third-party configuration issues; report reviewed by the VRP panel across three decision cycles.
Bug Bounty Researcher - Salesforce
(2026-02)
Salesforce Product Vulnerability Response (PVR)
- Reported an unauthenticated S3 ListObjectsV2 API endpoint exposing public object enumeration, enabling asset inventory mapping and internal structure discovery.
- Collaborated with Salesforce Security (Case #03675767) to clarify findings; provided supplementary analysis distinguishing enumeration risk from sensitive data exposure.
Bug Bounty Researcher - HackerOne
Private Programs (Netflix, Bumba, Dyson)
- Netflix — LFI on *.nflxvideo.net: Able to access /etc/passwd and other system files. (Informative)
- Bumba — S3 bucket unauthorized file upload via misconfigured endpoint. (Duplicate)
- Dyson — Bypass via internal-use discount code leaking in API response. (Duplicate)
- Reported 30+ vulnerabilities in total, including 5+ duplicates and several informatives across private programs.
Bug Bounty Researcher - Nykaa
(2025-10)
Nykaa Bug Bounty Program
- Identified and responsibly disclosed a security vulnerability; awarded a Certificate of Appreciation (Severity: Low / P4) by the Chief Information Security Officer, Praveen Kumar.
- Certificate ID: d739a280-1148-4f0f-9c75-9ea6cf770881
Education
B.Tech - Digital Technologies Design and Planning (DTDP) - Dr. YSR Architecture and Fine Arts University (2021 - 2025)
Intermediate - Class 12 - Narayana Junior College (2019 - 2021)
10th Standard - Prathibha Model High School (2018 - 2019)
