Altaf Kakhandaki

Self-taught Cybersecurity Researcher and Bug Bounty Hunter with 2+ years of hands-on experience in web application security, API security testing, and business-logic vulnerability research. Practical expertise across recon, OWASP Top 10 exploitation, IDOR/BOLA, XSS, SSRF, and auth flaws, validated through active engagements on HackerOne, Bugcrowd, and Meta Bug Bounty. Full-stack developer background enables realistic exploitation of business-logic and API flaws.

Builds custom recon/automation tooling in Python and Go. Completed 100+ PortSwigger labs and 610+ TryHackMe rooms. Committed to responsible disclosure and continuous offensive-security research.

Independent Security Researcher at HackerOne, Bugcrowd, Meta Bug Bounty, PortSwigger Academy (2024-01 – Present)

• Perform end-to-end vulnerability research on live production targets — recon, API endpoint enumeration, and business-logic testing — under responsible disclosure guidelines.
• Researched Meta AI (meta.ai): captured live network traffic to map GraphQL API endpoints and test conversation-ID enumeration for IDOR exposure.
• HDFC Bank private Bugcrowd program: identified anomalous UAT login behavior consistent with SQL injection; delivered a professional vulnerability report.
• Google VRP / YouTube: built a multi-account lab and applied low-privilege role-abuse and cross-surface privacy testing methodology.
• Unico IDtech (HackerOne): testing API endpoints, redirect chains, and business logic across a biometric identity verification platform.
• Received private bug bounty program invitations on Bugcrowd based on researcher activity and reputation.

Offensive Security – Self-Directed Study

BSC computer science dropout