SECURITY RESEARCHER / PRODUCT SECURITY
I build and break the systems behind modern software — from binary exploit research to secure-by-default AI development.
Research, reports, and responsible disclosure across teams that build at scale.
NASANASA
●Apple
WHOWorld Health Organization
BBCBBC
DDrexel University
CUniversity of CambridgeTHE RESEARCH LOOP / INTERACTIVE
A good finding is not a screenshot of a problem. It is a story with a beginning, a mechanism, and a way out.
Turn a suspicion into a repeatable path with evidence an engineering team can act on.
SELECTED WORK / CASE FILES
Each project is a working argument: here was the risk, this was the mechanism, and this is what a stronger system looks like.
Proof-driven MCP security research that turns a static weakness into a live exploit path.
Nightcrawler maps the distance between a finding and a failure that a team can reproduce. The work focuses on risky tool boundaries, impact validation, and making the path legible enough to fix.
An in-repo secure coding agent for LLMs, pre-commit hooks, SCA, and safer dependencies.
VibeGuard brings security feedback into the moment code is written. It combines an agent workflow with static analysis and dependency checks so teams can move quickly without making security somebody else’s queue.
Two-tier testing infrastructure built for repeatable enterprise risk assessment.
Obsedian Guard turns one-off assessment knowledge into a repeatable testing surface. The system separates signal collection from analyst validation so findings can be compared, reproduced, and communicated with confidence.
Security is not a vibe.— field note / pruthu raut
It is a path you can prove.
FIELD NOTES / EXPERIENCE
Different environments, same instinct: find the boundary, understand the mechanism, and leave the system better than I found it.
LLM security harnesses, binary analysis, Semgrep rules, and secure-coding workflows.
100+ vulnerabilities across 30+ enterprise programs including NASA, Apple, WHO, and BBC.
Reverse engineering, LPE/RCE research, and proof-of-concept exploit development.
50+ assessments and OWASP-aligned secure coding guidance.
CREDENTIALS / SIGNAL CHECK
Certifications and field wins are part of the operating system — useful signals, never a substitute for doing the work.
VERIFIED FIELD SIGNAL • AVAILABLE ON REQUEST
VERIFIED FIELD SIGNAL • AVAILABLE ON REQUEST
VERIFIED FIELD SIGNAL • AVAILABLE ON REQUEST
VERIFIED FIELD SIGNAL • AVAILABLE ON REQUEST
VERIFIED FIELD SIGNAL • AVAILABLE ON REQUEST
VERIFIED FIELD SIGNAL • AVAILABLE ON REQUEST
ABOUT THE OPERATOR / PRUTHU RAUT
Cybersecurity researcher focused on penetration testing, vulnerability research, exploit development, cloud security, and secure-by-default AI tooling.
Currently pursuing an M.Eng. in Cybersecurity at the University of Maryland, College Park. I move comfortably from reverse engineering a binary to designing the guardrails that keep an engineering team from repeating the same mistake.
CURRENT LOADOUT
Every claim should resolve into an artifact, a reproduction, or a measurable improvement.
The best defensive work gives builders a clear next move without hiding the technical truth.
Find the edge case, explain the mechanism, ship the fix, and verify it stayed fixed.
OPEN CHANNEL / 04
Bring the system, the strange behavior, or the question nobody has isolated yet.
Let's test it