Chinmay Prawah PantContact

Chinmay Prawah Pant

MSc Cybersecurity, KTH Royal Institute of Technology · Stockholm, Sweden

Software Engineer and Cybersecurity enthusiast, based in the Silicon Valhalla, where the startups are many and the daylight is not. I love working at the intersection of software, security, and AI.

Looking for something exciting to contribute to; internships or part-time opportunities
01

Selected security work

Security research, engineering work and tooling.

ToolingIn progress

ActionLens: a security scanner for GitHub Actions

Personal projectCI/CD pipelines hold source code, cloud credentials and release keys. ActionLens audits GitHub Actions workflows for the flaws that let attackers reach them.CI/CD securitySASTDASTSupply chainPythonGoShow details
  • Taint analysis traces untrusted input, such as PR titles and issue bodies, into run: scripts to catch script injection, and flags pull_request_target workflows that check out untrusted fork code.
  • Lint rules catch unpinned and typo-squatted third-party actions, missing or over-scoped token permissions, and self-hosted runners on public repos.
  • Each rule maps to the OWASP Top 10 CI/CD Security Risks and a CWE. A Go parser built on actionlint feeds a Python analysis engine.
  • Next: a dynamic verification stage that runs flagged workflows in a sandboxed test repo with a harmless canary payload and checks the runner logs, so only exploitable findings are reported.
Repository →
Tooling2026

Improving endpoint discovery in OWASP Noir

Noir maps a codebase's endpoints and inputs so testers know what to attack. I improved its Next.js analysis and built its npm release pipeline.Attack surfaceStatic analysisSupply chainNext.jsShow details
  • Noir now detects headers and cookies read through constants, such as webhook signature headers, in Next.js, Express, Koa and Hono apps. Previously these inputs were missed entirely.
  • Next.js Server Actions are now reported as their own endpoint type, and form-data bodies list each field.
  • Found and reported four gaps in Noir's Next.js analysis, and added regression tests that keep commented-out code out of scan results.
  • Documented 10 GitHub Action inputs that had no documentation
  • Built Noir's npm release pipeline (npx @owasp-noir/noir), secured against supply-chain attacks: it publishes through Trusted Publishing with signed provenance, and pins each binary's SHA-256 so installs refuse a tampered download.
Engineering2026

Scaling the OWASP Secure Headers web scan

OWASP Secure Headers ProjectOSHP reports how widely the web's top sites use security headers like CSP and HSTS. A 6-hour CI limit capped its monthly scan at 150K domains.HTTP security headersPythonasyncioGitHub ActionsShow details
  • Rewrote the scanner with asyncio: ~2.2× faster, coverage up from 150K to 250K domains.
  • Fixed failures that only appeared at scale: DNS rate limits, pool exhaustion, oversized CSP headers.
  • Moved generated datasets from Git to versioned releases, ending merge conflicts.
02

Engineering

Work I've done so far, and how it shapes the way I approach security.

  • Systems & Security Engineer (Part-time) · Locus

    Dec 2025 — Apr 2026

    TravelTech, global. A DeFi-powered travel platform with on-chain stablecoin rewards.

    • Built the booking and payments platform from scratch to production in 2 months using Next.js and Express.
    • Implemented wallet-based authentication and role-based access control across customer and internal roles.
    • Worked with developers to enforce secure development in CI with Dependabot, gitleaks, branch protection and mandatory code review, catching 15+ vulnerable dependencies and exposed secrets in the first 90 days.

  • Software Engineer · Gamezop

    Aug 2024 — Nov 2025
    • Built a custom Next.js UI library that parsed and rendered Payload CMS rich text, with sanitization during serialization to mitigate XSS.
    • Engineered a modular analytics SDK processing 100M+ events monthly across 5+ products.
    • Led incident response for a live botnet attack: analysed logs to identify the attack, then mitigated it with rate limiting and normalized API error responses.

  • SDE-1 · Growagro

    Jun 2023 — Jul 2024
    • Built an in-house dashboard for employee and analytics data, with strict role-based access control over sensitive records.
    • Built backend services and REST APIs in Python to process data and integrate in-house ML models into production.
    • Implemented Auth0-based identity and access management with MFA, SSO, and token-based authentication

03

Research

Publications and preprints

  • arXiv2025

    SCI-IoT: A Quantitative Framework for Trust Scoring and Certification of IoT Devices

    Shreyansh Swami, Ishwardeep Singh, Chinmay Prawah Pant

    Proposed a quantitative certification framework benchmarking IoT trustworthiness via 30 weighted security tests and a six-tier grading model to standardize compliance.

    arXiv:2511.18045 →
  • arXiv2025

    Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules

    Shreyansh Swami, Ishwardeep Singh, Ujjwalpreet Singh, Chinmay Prawah Pant

    Analyzed 8 polymorphic behaviors against commercial AVs and EDRs, demonstrating that hybrid detection pipelines significantly outperform standalone defences with 92% coverage.

    arXiv:2511.21764 →
04

Certifications

Certifications and programmes.

  • AGI & AI Safety Cohort · BlueDot Impact

    Jul 2026

  • Security+ · CompTIA

    Dec 2025

  • Linux Certified Investigator · CSI Linux

    Oct 2022
05

Community & Open Source

Hackathons, mentoring, volunteering, and open-source involvement.

  • Open-source contributor

    Present

    Contributed to OWASP projects including OSHP and Noir, and exploring contributions to projects such as NVIDIA Garak and Agent Memory Guard.

  • Organising team · KongligCTF 2026

    2026

    Part of the organising team for KongligCTF 2026, the first CTF hosted at KTH.

  • Volunteer · Cybersweden '26, Cybercampus Sverige

    Sept 2026

    Volunteered at Cybersweden '26, organised by Cybercampus Sverige.

  • Contributor · Stack Overflow

    May 2023 — 2025

    Top 5% global contributor (1,000+ reputation) in programming and security, reaching 25,000+ developers.

  • Hackathon particpant, mentor & organiser

    2022 — Present

    Participated in and mentored at 30+ hackathons, including Tech Europe Agentic AI Hack and Lovable Hackathon. Co-organised two editions of India's largest student-run hackathon, managing operations for 2,500+ attendees.

  • Volunteer contributor · CSI Linux

    Aug 2022 — May 2024

    Contributed to the open-source CSI Linux project, improving its OSINT and digital forensics tooling alongside a global community of security professionals.