Skip to content
View Neelagiri65's full-sized avatar
6 followers · 49 following

Achievements

Achievement: Pull Sharkx3Achievement: QuickdrawAchievement: YOLOAchievement: Pair Extraordinaire

Achievements

Achievement: Pull Sharkx3Achievement: QuickdrawAchievement: YOLOAchievement: Pair Extraordinaire

Organizations

@gawk-dev

Block or report Neelagiri65

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Neelagiri65/README.md

Srinathprasanna Shanmugam — Independent Security Research

I do authorised, scope-limited security research, primarily source-code review of open-source software and coordinated disclosure of reproducible vulnerabilities (SSRF, deserialization RCE, authorisation bypass). I also build small, focused developer and compliance tools.

Operating as Nativerse Ventures · London · Human-in-the-loop, in-scope only.

Selected security work

  • Google Agent Development Kit — authored the SSRF-protection fix for RestApiTool / OpenAPIToolset (blocks loopback, private, link-local and cloud-metadata targets by default), merged upstream → commit 30726ea via #6003
  • picklescan (Hugging Face Hub's pickle malware scanner) — reporter on a denylist-bypass code-execution advisory, GHSA-x5w2-265w-4cph (in maintainer triage)
  • dexidp/dex — reporter on an OAuth connector-ACL bypass, GHSA-gqgv-7xgf-8w9m (in maintainer triage)
  • gmail-oauth-research — a large-scale code-pattern audit surfacing open-source projects that key Google OAuth on the mutable email field instead of the stable sub claim
  • authdrift — static analysis for OAuth handlers that break when a user changes their Gmail address

Tools I maintain

  • mcpgawk — a local gateway in front of the MCP servers your agents use: baselines each server's tools, flags changes since you approved them, and holds calls to changed tools until you re-approve
  • equiv — deterministic checker for behaviour-preserving code changes: runs old and new versions on the same generated inputs and emits a signed, re-runnable receipt
  • bharataddress — deterministic, offline parser for messy Indian addresses (26,711 pincodes, DIGIPIN encode/decode, phonetic alias matching, zero required dependencies)
  • aipulse — real-time observatory for the global AI ecosystem; figures link to their sources

Early / experimental: privacylint — SwiftSyntax scanner for App Store privacy-manifest issues (ITMS-91053 / 91061)

Working with

Python · TypeScript · Swift · Elixir / Phoenix

Contact: brindha [at] nativerse-ventures.com · nativerse-ventures.com

All research is conducted within authorised programme scope or via coordinated disclosure with maintainers.

Pinned Loading

  1. bharataddress bharataddress Public

    Deterministic, offline parser for messy Indian addresses. 26,711 pincodes embedded with OSM centroids, DIGIPIN encode/decode, phonetic alias matching (Gurgaon/Gurugram, Bengaluru/Bangalore), zero r…

    Python 4

  2. authdrift authdrift Public

    Find OAuth handlers that will break when users rename their Gmail.

    Python 1

  3. equiv equiv Public

    Deterministic checker for behaviour-preserving code changes. Signed, re-runnable receipts; PR gate; single static binary.

    Rust 4

  4. aipulse aipulse Public

    Real-time observatory for the global AI ecosystem. Every number cites its source.

    TypeScript

  5. gawk-dev/mcpgawk gawk-dev/mcpgawk Public

    One gateway in front of every MCP server your agents can reach. A server that changes after you approved it is caught, the call is blocked before it runs, and nothing leaves your machine.

    Python 1