const harshit = {
name: "Harshit Patel",
role: "Application Security Engineer",
focus: ["AppSec", "Secure Code Review", "VAPT", "Threat Modeling", "OWASP Top 10"],
certified: "Google Cybersecurity Professional Certificate",
learning: ["AI / LLM Security", "AI Red-Teaming"],
writesOn: "Medium",
reachMe: "harshitp1971@gmail.com",
};- 🛡️ Application Security Engineer securing web apps & APIs across the SDLC
- 🔎 Hands-on with secure code review, VAPT, and threat modeling (OWASP Top 10)
- 🎓 Google Cybersecurity Professional Certificate holder
- 🤖 Currently learning AI / LLM security & AI red-teaming
- 🧰 I build my own security tooling:
js_endpoint— recon tool to discover JS endpoints & hunt hard-coded secretsip_finder— OSINT tool to uncover real server IPs behind CDNs/WAFsai-assisted-burp-extension— Burp extension using AI to triage HTTP traffic
- 📚 Author of Book — a practical guide to web hacking vulnerabilities & methodology
- 🌐 Founder of EpochCyber — blogs, tools & resources for the security community
- ✍️ I write on Medium and 🐍 code in Python
- 📫 Reach me at harshitp1971@gmail.com
An empirical study comparing Large Language Models vs. SAST tools for detecting usage-level JWT vulnerabilities in Python — the kind dependency scanners miss because they live in how code uses a library, not the library itself.
- 🧪 Built a 252-sample labeled dataset (119 vulnerable / 133 safe) + scoring harness
- 📉 Showed SAST baselines miss it: Bandit F1 0.28, Semgrep F1 0.40 — recall 0.00 on 6 semantic flaw classes (alg confusion,
kidpath traversal, missingexp/aud/iss, etc.) - 🤖 Motivates semantic, LLM-based vulnerability detection · Read more →
| Project | Description | Stars |
|---|---|---|
| js_endpoint | Discover JavaScript endpoints & hunt secrets |  |
| ip_finder | OSINT tool to find real IPs behind CDNs/WAFs |  |
| ai-assisted-burp-extension | Burp extension using AI for traffic analysis |  |
| Book | Web hacking vulnerabilities & methodologies |  |
