Hitarth Jain

AI security researcher focused on prompt injection and the instruction/data boundary. Build measurement-based benchmarks with reproducible numbers and published write-ups. Research spans web, firmware, cloud and blockchain security, investigating where systems trust input they shouldn't. Available immediately for remote or Bengaluru positions, graduating Sep 2027.

Independent Security Researcher — Vulnerability Research & Bug Bounties at HackerOne, Intigriti, Bugcrowd (2025-01 – Present)

• Coolblue — reflected XSS chained with an unauthenticated cookie leak into full account takeover. Critical, €1,337 bounty.
• ARM TF-M — uninitialized Secure-world stack disclosure via the psa_fwu_query firmware-update API. $3,000 bounty.
• Command injection → RCE in a security vendor's VS Code extension UNDER COORDINATED DISCLOSURE — 12.5k installs. POSIX shell-escaping applied correctly, then re-quoted by a Windows regex that left the shell metacharacter outside quoting; triggered by merely opening an untrusted repository. Proven on real Windows Server via CI runners; reproduced by the program's triage team.
• Exodus — unauthenticated write endpoint on a production API. Resolved.
• CometBFT — consensus-layer bug affecting 50+ downstream blockchains; further reports across Cosmos SDK, EVM and IBC.
• PayPal — SSRF via protocol smuggling.

B.Sc. Computer Science in Computer Science – Scaler School of Technology, Bengaluru (2024-08 – 2027-09)