I'm a cybersecurity engineering student at Anna University, class of 2028. Most of my time goes into secure messaging and applied crypto. I do security R&D at GRMG LLC, where I'm building AION Protocol, a secure peer-to-peer communications platform.
tamperlog (pip install tamperlog) is a Python library for append-only logs you can actually prove things about. Most tamper-evident log code chains hashes together, which catches an edited row but quietly misses truncation, since deleting the last few entries leaves the chain perfectly self-consistent. tamperlog uses RFC 6962 Merkle proofs instead, so a small checkpoint you published earlier is enough to prove the log still holds what it did before, in the same order, with nothing dropped. No dependencies, fully typed.
SAATCHI (சாட்சி) is a wage record system for daily wage workers in India. A worker sends a voice note, the system transcribes it, verifies the speaker's voice print, and seals the record into a hash chain anchored to Bitcoin. If anyone tampers with a record later, the public verification page turns red. Built with my team, Nexus Network, for a national AI competition.
SBLC Platform manages Standby Letters of Credit for banks, from issuance through KYC/AML compliance to loan disbursement, with role-based access for every party involved. FastAPI, PostgreSQL and Redis under the hood.
AION Protocol is my main work at GRMG. End-to-end encrypted peer-to-peer messaging with a tamper-evident integrity ledger. That repo stays private for now.
GRMG's website is one I designed and built end to end in React, then translated into 32 languages, including full right-to-left support.
react-vite-starter-mipe is the small React + Vite template I clone whenever I start something new.
I contribute where I actually use things, and I try to send a failing test along with the report.
Three have landed so far. The OWASP Cheat Sheet Series now carries a section I wrote on JWT verification keys, about what goes wrong when an application takes its key from the token's own jwk, jku, x5u or x5c header without tying the result back to something it already trusted. In securesystemslib, which python-tuf is built on, the signer accepted only P-256 ECDSA keys even though the rest of the library already verified P-384 and P-521. Fixing that turned up a second problem nobody had filed: a key on one curve could be paired with a scheme for another, and it would sign quite happily, producing signatures that could never verify. In scapy, Modbus register arrays read twice as far as they should because a byte count was being used where an element count belonged, so parsing one message swallowed the header of the next.
There is more in review, including a silent data-loss fix in Alembic's SQLite batch migrations, where a TypeDecorator wrapping JSON slips past an isinstance check and every value in the column is cast to 0, and an OIDC fix in django-oauth-toolkit, where RP-initiated logout was not idempotent so a second relying party got rejected instead of its redirect.
Systems where you don't have to take anyone's word for it. Hash chains, public verification pages, encryption that still holds up if the server is compromised. I also like shipping the whole thing myself: backend, frontend, deploys.
Python and FastAPI on the backend, React and TypeScript on the frontend, PostgreSQL, Redis and Docker for everything else.