Skip to content
View gl1tchdust's full-sized avatar
🙃
I may be slow to respond.
🙃
I may be slow to respond.
0 followers · 1 following

Block or report gl1tchdust

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
gl1tchdust/README.md

Shivam Mahajan

Application security engineer. API security, authorization testing, DevSecOps pipelines. Pune, India.

Repositories

  • devsecops-pipeline-lab - a security toolchain in CI with custom Semgrep rules for BOLA, BFLA and mass assignment, scored against hand-labelled ground truth. Measured precision decides which rules are allowed to fail a build.
  • api-authz-testing-playbook - runnable test cases for OWASP API authorization flaws. A differential probe replays each case as owner, peer and anonymous; every request example is a verbatim capture from a live target.
  • newman-oauth-refresh - OAuth2 token refresh for Newman collection runs, which Postman's CLI does not do. Proactive for JWTs, reactive on 401 for opaque tokens, never written to disk. Published on npm.
  • agent-tool-authz - authorization for LLM agent tool calls. A detector that checks whether an MCP server's tools do what they declare, measured at precision 0.800 over 289 tools in four real codebases, and a gate that enforces policy over them.

Working with

Semgrep, Trivy, Burp Suite, OWASP ZAP, Python, GitHub Actions, MCP

Elsewhere

LinkedIn

Pinned Loading

  1. devsecops-pipeline-lab devsecops-pipeline-lab Public

    Security toolchain CI with custom Semgrep authorization rules, scored against hand-labelled ground truth

    Python

  2. api-authz-testing-playbook api-authz-testing-playbook Public

    Runnable OWASP API authorization test cases with a differential probe, validated against live targets

    Python

  3. newman-oauth-refresh newman-oauth-refresh Public

    OAuth2 token refresh for Newman: proactive for JWTs, reactive on 401 for opaque tokens, never written to disk

    JavaScript

  4. agent-tool-authz agent-tool-authz Public

    Authorization for LLM agent tool calls: a detector that maps an MCP server's authorization surface, a gate that enforces policy over it, and the attack suite that measures both

    Python