--- title: "Lohith Gowda M — Staff Application Security Engineer" description: "Security researcher and Application Security Engineer in Bengaluru, India. I build security programs from scratch for startups. Featured in TechCrunch." canonical: https://www.lohigowda.in/ last-updated: 2026-10-10 lang: en --- # Lohith Gowda M — Staff Application Security Engineer > I build security programs from scratch for startups. I’m Lohith Gowda M, Staff Application Security Engineer at [Atomicwork](https://www.atomicwork.com/) in Bengaluru. 7+ years across application, cloud and AI security, DevSecOps and offensive testing. I work with engineering to build security into applications, cloud infrastructure and AI workflows, and I run the compliance work that comes with it. **Focus areas:** AI & MCP Security · Supply Chain Security · Cloud Security · Application & API Security · Mobile Security · Compliance (SOC 2, ISO 27001) - Resume: https://www.lohigowda.in/resume.pdf - LinkedIn: https://www.linkedin.com/in/lohigowda/ - X: https://twitter.com/lohigowda_in - GitHub: https://github.com/lohigowda - Email: contact@lohigowda.in ## Featured in > “The issue, discovered by security researcher Lohith Gowda, affected the API that Naukri used on its Android and iOS apps.” — TechCrunch, May 2025 - [TechCrunch: Naukri exposed recruiter email addresses, researcher says](https://techcrunch.com/2025/05/23/naukri-exposed-recruiter-email-addresses-researcher-says/) - [TechRadar: Another top employment website found exposing recruiter email addresses](https://www.techradar.com/pro/security/another-top-employment-website-found-exposing-recruiter-email-addresses) - [The Economic Times: Naukri bug exposed recruiter email IDs via mobile apps](https://economictimes.indiatimes.com/tech/technology/naukri-bug-exposed-recruiter-email-ids-via-mobile-apps-report/articleshow/121389386.cms) Also covered by: [Yahoo Finance](https://finance.yahoo.com/news/naukri-exposed-recruiter-email-addresses-023000309.html), [NewsBytes](https://www.newsbytesapp.com/news/science/naukri-com-fixed-bug-exposing-recruiters-email-addresses/story), [Perplexity](https://www.perplexity.ai/page/naukri-fixes-recruiter-email-l-axhJ_2nMTBquvu8HvRJJYg), [Paubox](https://www.paubox.com/blog/naukri-fixes-bug-that-exposed-recruiter-email-addresses), [Radom](https://www.radom.com/insights/researcher-discovers-job-portal-vulnerability-revealing-recruiter-email-addresses), [CyberMaterial](https://www.cybermaterial.com/p/naukri-fixes-bug-that-exposed-recruiter-email-addresses), [The420.in](https://the420.in/naukri-com-recruiter-email-leak-api-bug-security-flaw/), [Tech Behind Fintech](https://techbehindfintech.com/technology/naukri-exposed-recruiter-email-addresses-researcher-says), [Success Quarterly](https://successquarterly.com/data-security-breach-exposes-recruiter-emails-on-naukri-com-a-call-for-enhanced-vigilance/), [Washington Weekly Times](https://washingtonweeklytimes.com/technology/naukri-exposed-recruiter-email-addresses-researcher-says/), [Abijita](https://www.abijita.com/naukri-com-fixes-bug-that-exposed-recruiters-email-addresses/). ## Research & disclosures I report vulnerabilities and contribute to security tooling. These are selected disclosures and merged contributions, with links to the public records. The rest went through private programs and stay confidential. ### Brave iOS: Private-tab Face ID authentication bypass (2026) Reported a deep-link path that bypassed the private-tab Face ID check on an unlocked iPhone. Brave fixed the issue and credited the report in its release notes. - [Release notes](https://github.com/brave/brave-browser/blob/master/CHANGELOG_iOS.md#192144) - [Issue](https://github.com/brave/brave-browser/issues/56187) - [Fix by Brave](https://github.com/brave/brave-core/pull/37469) ### E2B: BTF and eBPF tracing support in sandbox kernels (2026, Open source) I contributed two merged PRs to E2B’s guest kernels, enabling BTF and eBPF tracing support on x86_64 and ARM64 for runtime-security tooling. - [PR 26 · BTF support](https://github.com/e2b-dev/fc-kernels/pull/26) - [PR 27 · Tracing support](https://github.com/e2b-dev/fc-kernels/pull/27) ### Naukri: Recruiter email disclosure through mobile API (2025) Reported an API issue in Naukri’s mobile apps that returned recruiter email addresses. Naukri fixed it after disclosure; covered above. - [TechCrunch](https://techcrunch.com/2025/05/23/naukri-exposed-recruiter-email-addresses-researcher-says/) - [TechRadar](https://www.techradar.com/pro/security/another-top-employment-website-found-exposing-recruiter-email-addresses) - [The Economic Times](https://economictimes.indiatimes.com/tech/technology/naukri-bug-exposed-recruiter-email-ids-via-mobile-apps-report/articleshow/121389386.cms) ### Cursor: Broken access control in team billing API (2024, GHSA-g4ff-54cv-h6f9) Reported an authorization flaw that let non-admin team members access the team’s billing page. Cursor restricted access to admins and credited the report in its advisory. - [Vendor advisory](https://github.com/cursor/cursor/security/advisories/GHSA-g4ff-54cv-h6f9) ### Firefox iOS: Open redirect via QR scanner (2024, CVE-2024-0953) Reported that the QR scanner opened a destination without asking for confirmation. Mozilla credited the finding and fixed it in Firefox for iOS 129. - [Mozilla advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2024-36/#CVE-2024-0953) - [Write-up](https://blog.lohigowda.in/unveiling-cve-2024-0953-firefox-ios-open-redirect-vulnerability-57533efb4cf4) - [Video](https://www.youtube.com/watch?v=VLx3TPUezkk) ### Cloudflare: Blind SSRF and password-policy bypass (2022) Reported a blind SSRF caused by a Sentry configuration, and separately a password-policy bypass where the server accepted passwords the UI rejected. Both fixed and disclosed. - [SSRF report](https://hackerone.com/reports/1467044) - [Password-policy report](https://hackerone.com/reports/1675730) - [Write-up](https://blog.lohigowda.in/securing-cloudflare-addressing-the-password-policy-bypass-issue) **Researcher profiles:** [HackerOne](https://hackerone.com/lohigowda) · [Bugcrowd](https://bugcrowd.com/h/lohigowda) · [Intigriti](https://app.intigriti.com/profile/lohigowda) · [BugBase](https://bugbase.ai/profile/lohigowda) **Other public acknowledgements:** [Google](https://bughunters.google.com/leaderboard/honorable-mentions), [Amazon](https://hackerone.com/amazonvrp/thanks/2023?type=team#:~:text=47-,lohigowda,-48), [LinkedIn](https://hackerone.com/linkedin/thanks/2023#:~:text=30-,lohigowda,-30), [Uber](https://hackerone.com/uber/thanks/2024#:~:text=97-,lohigowda,-98), [BMW Group](https://app.intigriti.com/programs/bmw/bmwgroup-automotive/leaderboard?alltime=true&severity=1&search=lohigowda), [1Password](https://bugcrowd.com/h/lohigowda#:~:text=Shogun%20Level%204-,Hall%20of%20Fame,-Showing%20the%20top), [Robinhood](https://hackerone.com/robinhood/thanks/2024#:~:text=6-,lohigowda,-Robinhood%20Markets%20Bounty), [Automattic](https://hackerone.com/automattic/thanks/2024#:~:text=51-,lohigowda,-52), [Flipkart](https://www.flipkart.com/pages/security#:~:text=Ibrahim%20Saud%20M-,Lohith%20Kumar%20M.D,-Raju%20Kumar%20(Mrcyberwarrior), [Swiggy](https://www.swiggy.com/bug-bounty-hall-of-fame), [PhonePe](https://www.phonepe.com/report-vulnerability#hall-of-fame:~:text=Kumar%20Sah%20(CyberBeast)-,Lohith%20Gowda%20M,-Chaitanya%20Surabhi), [Zomato](https://hackerone.com/eternal/thanks/2023?type=team#:~:text=15-,lohigowda,-29), [Blinkit](https://hackerone.com/eternal/thanks/2022#:~:text=12-,lohigowda,-12), [Nexo](https://app.intigriti.com/programs/nexo/nexo/leaderboard?alltime=true&severity=1&search=lohigowda), [Sorare](https://hackerone.com/sorare/thanks/2023#:~:text=3-,lohigowda,-Reputation%3A%2022), [BugBase](https://bugbase.ai/programs/bugbase#:~:text=8-,lohigowda,-37), [Adafruit](https://www.adafruit.com/responsibledisclosurethanks#:~:text=Varun%0ANick%0AKunal-,Lohith,-Mayank%0AKunal%20Narsale), [Cloudways](https://app.intigriti.com/programs/digitalocean/cloudways/leaderboard?alltime=true&severity=1&search=lohigowda), [Hostinger](https://hackerone.com/hostinger/thanks/2022#:~:text=16-,lohigowda,-16), [Groww](https://bugbase.ai/programs/groww#:~:text=twitter.com/devendrahyalij-,Lohith%20Gowda%20M,-%2D%20https%3A//twitter.com), [Soundtrack](https://app.intigriti.com/programs/syb/soundtrackyourbrand/leaderboard?alltime=true&severity=1&search=lohigowda), [BigBasket](https://tech.bigbasket.com/security-at-bigbasket-5eaaa6fa7c89#:~:text=Kshitiz%20Raj-,Lohith%20Gowda%20M,-Magesh%20Baskaran), [Media Markup](https://mediamarkup.gitbook.io/docs/security/hall-of-fame#:~:text=Website-,Lohith%20Kumar%20MD,-Website). ## Experience Seven years across five startups, usually as the first or only security hire. Each role below is where I built the program from scratch. ### Staff Application Security Engineer — [Atomicwork](https://www.atomicwork.com/) Jan 2026 - Present · Bengaluru, India · Hybrid I lead security at Atomicwork and am building the program from the ground up across application, cloud and AI. Much of my time goes into testing how our AI agents and MCP integrations can be abused, reviewing new designs before they ship, and putting security checks into the CI/CD pipeline so problems get caught early. I run the bug bounty program, and when something is found, I usually raise the fix with engineering myself. ### Senior Security Engineer — [Acko](https://www.acko.com/) Jun 2025 - Jan 2026 · Bengaluru, India · On-site Acko is an insurance company, so customer data was the priority. I built an internal SBOM dashboard that shows every repository’s dependencies and vulnerabilities in one place and alerts the team on Slack when something critical or malicious appears. I also launched the public bug bounty program, tested the web and mobile apps myself, and tightened cloud security across AWS and GCP. ### Senior Security Engineer — [Plivo](https://www.plivo.com/) Jun 2023 - Jun 2025 · Bengaluru, India · Remote Plivo runs communications APIs for other businesses, so supply-chain and cloud risk mattered most. I built the pipelines that scan every dependency and generate SBOMs, a package firewall that blocks malicious open-source packages before they install, and secret and code scanning in CI/CD. On the cloud side I moved us to AWS WAF with alerting on GuardDuty and CloudTrail events, and automated AWS Inspector triage so reviews that took days took hours. ### Senior Security Engineer — [Airmeet](https://www.airmeet.com/) May 2021 - Jun 2023 · Bengaluru, India · Remote I was Airmeet’s only security engineer, so everything started from zero. I set up security testing for the APIs, mobile apps and cloud, opened a vulnerability disclosure program and handled the reports that came in, wrote custom Cloudflare WAF rules, and tested every production release. I also took Airmeet through ISO 27001 and SOC 2 end to end, from the controls to the evidence to the auditors. ### Security Engineer — [Reward360](https://www.reward360.ai/) Jul 2019 - May 2021 · Bengaluru, India · On-site My first security role. I conducted internal and external penetration testing across web, mobile, network, and API environments. I also managed OS patching and vulnerability remediation cycles, including log reviews and verification before and after patching, and collaborated with engineering and DevOps teams to resolve production issues. ## Blogs - [Git Exposure: How a Simple Oversight Led to a Critical Security Flaw](https://blog.lohigowda.in/git-exposure-led-to-critical-security-flaw) — Aug 12, 2024 · 2 min read - [Securing the Cloud: From S3 Credentials to RDS Database Access](https://blog.lohigowda.in/securing-the-cloud-from-s3-credentials-to-rds-database-access) — Apr 18, 2024 · 3 min read - [Unveiling CVE-2024-0953: Firefox iOS Open Redirect Vulnerability](https://blog.lohigowda.in/unveiling-cve-2024-0953-firefox-ios-open-redirect-vulnerability-57533efb4cf4) — Feb 6, 2024 · 1 min read - [A Fare-Validation Flaw in Namma Metro’s QR Ticket Flow](https://blog.lohigowda.in/how-i-got-free-travel-on-namma-metro-75066fabc5a0) — Mar 16, 2023 · 2 min read - [Securing Cloudflare: Addressing the Password Policy Bypass Issue](https://blog.lohigowda.in/securing-cloudflare-addressing-the-password-policy-bypass-issue) — Sep 30, 2022 · 2 min read - [Paytm's Broken Link Flaw](https://blog.lohigowda.in/paytms-broken-link-flaw) — Jan 28, 2022 · 2 min read All posts: https://blog.lohigowda.in/ ## Talks - [AI in Cloud Security](https://talks.lohigowda.in/ai-in-cloud-security) — How leaked application credentials can lead to cloud database access, and which cloud events to monitor to detect it early. All talks: https://talks.lohigowda.in/ ## Contact Building a security team, looking for an advisor, or planning a talk? Let’s talk. Email contact@lohigowda.in. Canonical page: https://www.lohigowda.in/ · Machine-readable: https://www.lohigowda.in/llms.txt · Sitemap: https://www.lohigowda.in/sitemap.xml