RitikArora.
I break things.
Then write very polite emails.
Security researcher. Developer. Music producer. An inconvenient amount of curiosity.
Curiosity,
with receipts.
Some people have hobbies.
I have increasingly complicated repositories.
01Crakrr
Security research / Desktop softwareBEST PAPER
ICCDM 2026
Crakrr
Security research / Desktop softwareWhat if a scanner
could reason?
A web vulnerability assessment research project exploring how language models can help make sense of an application. Built with a custom OpenGL interface, because security software can have a point of view, too.
Awarded Best Paper at ICCDM-2026.
The bit that mattered
Separating useful assessment from confident-sounding output. The research explores model-assisted analysis; the interface explores how many hours I can spend on something nobody asked to be animated.
Unexpected side quest: writing shaders for a security tool.02At race pace.
EV telemetry / Embedded systemsPATENT
PUBLISHED
At race pace.
EV telemetry / Embedded systemsWhat is the car
actually doing?
A modular telemetry system for a Formula Student EV. A custom Teensy 4.1 PCB samples IMU, CAN, and analog sensors at 100 Hz. A PyQt ground station turns those signals into motor phasors and torque-ripple measurements.
Co-inventor · Patent application published.
The bit that mattered
The network is not always invited to race day. A dual-path pipeline pairs wireless telemetry with local SD logging when connectivity drops. On the ground, the display helps turn “the motor feels weird” into a measurement.
Lesson learned: the car is fast. Electromagnetic interference is faster.03Shushhh
Private communication / CryptographyOPEN SOURCE
C++17
Shushhh
Private communication / CryptographyHow private
is private?
A terminal-based messenger exploring hybrid classical and post-quantum key exchange. X25519 and ML-KEM-768 establish keys, ChaCha20-Poly1305 encrypts messages, and Tor provides the transport.
Built in C++17 · MIT licensed.
The bit that mattered
Combining classical and post-quantum primitives without pretending that choosing an algorithm solves the whole security problem. Protocol design, implementation, and handling sensitive data all deserve the same scrutiny.
A messenger for people who consider “probably fine” a threat model.04NoiseNet
Image protection / Adversarial MLDEFENSIVE
RESEARCH
NoiseNet
Image protection / Adversarial MLCan an image
protect itself?
A defensive research project using subtle image perturbations to interfere with deepfake generation. DCT frequency embedding and transformation-based augmentation explore resilience to cropping, resizing, and compression.
Parallel GPU / Intel NPU training pipeline.
The bit that mattered
A perturbation that works on one pristine image is only the beginning. This project investigates how protection behaves after the crops, resizes, and re-encoding that real images go through.
Teaching computers to mind their own business. A work in progress.Trust is a
boundary.
vulnerabilities responsibly disclosed.
Across software people use every day.
Authentication token exposure across a Binder IPC boundary.
01Universal cross-site scripting in the wallet’s DApp browser.
02A Stories-related denial-of-service issue, reported to Meta.
03Wallet security research through responsible disclosure.
04Multiple issues reported through coordinated disclosure.
05Selected disclosures. Technical details are intentionally kept brief.
Breaking things is the easy part.
The report is where you earn it.
I’m interested in the gap between what a system promises and what it actually protects. Android internals, embedded browsers, and places where one component trusts another a little too much.
A good report makes the problem understandable, the impact clear, and the fix easier to get right. The goal is a patch. The professionally worded email is just part of the journey.
Some flags. A few trophies.
TEAM EXSTAGIUMByteMe CTF
OWASP PCCoE
TENET CTF 2025
AISSMS IOIT
Shaastra qualifiers
IIT Madras · Finalist
Pentathon 2025
NCIIPC · National finals
Also 4th globally at H7CTF. The trophies are real. The movie-hacker typing speed is not.
A little
hard to
categorize.
The same curiosity that makes me take software apart makes me want to build it better.
I’m a security researcher, developer, and music producer from Pune. I got into this by asking why things worked. Finding out why they didn’t turned out to be more interesting.
That’s taken me from Android internals and wallet browsers to embedded electronics in a Formula Student car. And when I need a different kind of problem, I open a DAW.
Computer Engineering
Vishwakarma Institute of Technology · Class of 2028
Co-Head, App Development
Google Developer Group · VIT Pune
Python / C++ / Kotlin / Flutter
Ghidra / Frida / Burp Suite
Embedded C / PyQt / OpenGL
Same brain.
Different noise.
Sometimes the bug is a feature.
In music, we call that a texture.
Two moods. One person who should probably go to sleep. Press a cover to listen; the little glass player follows you around so you can keep exploring.
The unfiltered
footnotes.
The résumé has a dress code.
This bit doesn’t.
“I thrive at the intersection of innovation and problem-solving.”
A sentence that has technically said nothing.
Why aren’t there skill percentage bars?
Because “87% Python” raises more questions than it answers. Is the missing 13% pandas? Indentation? Emotional stability? I’d rather show you what I built.
Do you ever build something normal?
I gave a security research tool custom OpenGL shaders. The scanner did not request this. Neither did the paper reviewers. Here we are.
What’s it like working with you?
I like understanding the whole problem, explaining what I find, and making things work beyond the demo. At GDG VIT Pune, that also means mentoring a 10-person app team and helping run workshops for 500+ participants. Occasionally, I explain why “we’ll fix security later” is a fascinating proposal.
Are there actually things hidden here?
Three small discoveries. One rewards unreasonable stretching. One is suspiciously labelled below. The last understands an old game-controller sequence. If you’re on a phone, try the monogram five times. No prizes. Just evidence that you also ignore instructions.
