Chinmay Prawah Pant
MSc Cybersecurity, KTH Royal Institute of Technology · Stockholm, Sweden
Software Engineer and Cybersecurity enthusiast, based in the Silicon Valhalla, where the startups are many and the daylight is not. I love working at the intersection of software, security, and AI.
Selected security work
Security research, engineering work and tooling.
ToolingIn progressActionLens: a security scanner for GitHub Actions
Personal projectCI/CD pipelines hold source code, cloud credentials and release keys. ActionLens audits GitHub Actions workflows for the flaws that let attackers reach them.CI/CD securitySASTDASTSupply chainPythonGoShow detailsHide details
- Taint analysis traces untrusted input, such as PR titles and issue bodies, into
run:scripts to catch script injection, and flagspull_request_targetworkflows that check out untrusted fork code. - Lint rules catch unpinned and typo-squatted third-party actions, missing or over-scoped token permissions, and self-hosted runners on public repos.
- Each rule maps to the OWASP Top 10 CI/CD Security Risks and a CWE. A Go parser built on actionlint feeds a Python analysis engine.
- Next: a dynamic verification stage that runs flagged workflows in a sandboxed test repo with a harmless canary payload and checks the runner logs, so only exploitable findings are reported.
Tooling2026Improving endpoint discovery in OWASP Noir
Noir maps a codebase's endpoints and inputs so testers know what to attack. I improved its Next.js analysis and am working on a secure npm release path.Attack surfaceStatic analysisSupply chainNext.jsShow detailsHide details
- Noir now detects headers and cookies read through constants, such as webhook signature headers, in Next.js, Express, Koa and Hono apps. Previously these inputs were missed entirely.
- Next.js Server Actions are now reported as their own endpoint type, and form-data bodies list each field.
- Found and reported four gaps in Noir's Next.js analysis, and added regression tests that keep commented-out code out of scan results.
- Documented 10 GitHub Action inputs that had no documentation
- In progress: an npm release (
npx @owasp-noir/noir) published with Trusted Publishing and signed provenance.
Engineering2026Scaling the OWASP Secure Headers web scan
OWASP Secure Headers ProjectOSHP reports how widely the web's top sites use security headers like CSP and HSTS. A 6-hour CI limit capped its monthly scan at 150K domains.HTTP security headersPythonasyncioGitHub ActionsShow detailsHide details
- Rewrote the scanner with
asyncio: ~2.2× faster, coverage up from 150K to 250K domains. - Fixed failures that only appeared at scale: DNS rate limits, pool exhaustion, oversized CSP headers.
- Moved generated datasets from Git to versioned releases, ending merge conflicts.
Engineering
Work I've done so far, and how it shapes the way I approach security.
Systems & Security Engineer (Part-time) · Locus
Dec 2025 — Apr 2026TravelTech, global. A DeFi-powered travel platform with on-chain stablecoin rewards.
- Led development of a production platform and its supporting backend services.
- Owned platform security, code quality, and secure development practices.
Software Engineer · Gamezop
Aug 2024 — Nov 2025- Built a custom Next.js UI library that parsed and rendered Payload CMS rich text, with sanitization during serialization to mitigate XSS.
- Engineered a modular analytics SDK processing 100M+ events monthly across 5+ products.
- Led incident response for a live botnet attack: analysed logs to identify the attack, then mitigated it with rate limiting and normalized API error responses.
SDE-1 · Growagro
Jun 2023 — Jul 2024- Built an in-house dashboard for employee and analytics data, with strict role-based access control over sensitive records.
- Built backend services and REST APIs in Python to process data and integrate in-house ML models into production.
- Implemented Auth0-based identity and access management with MFA, SSO, and token-based authentication
Research
Publications and preprints
- arXiv2025
SCI-IoT: A Quantitative Framework for Trust Scoring and Certification of IoT Devices
Shreyansh Swami, Ishwardeep Singh, Chinmay Prawah Pant
Proposed a quantitative certification framework benchmarking IoT trustworthiness via 30 weighted security tests and a six-tier grading model to standardize compliance.
- arXiv2025
Adaptive Detection of Polymorphic Malware: Leveraging Mutation Engines and YARA Rules
Shreyansh Swami, Ishwardeep Singh, Ujjwalpreet Singh, Chinmay Prawah Pant
Analyzed 8 polymorphic behaviors against commercial AVs and EDRs, demonstrating that hybrid detection pipelines significantly outperform standalone defences with 92% coverage.
Certifications
Certifications and programmes.
AGI & AI Safety Cohort · BlueDot Impact
Jul 2026Security+ · CompTIA
Dec 2025Linux Certified Investigator · CSI Linux
Oct 2022
Community & Open Source
Hackathons, mentoring, volunteering, and open-source involvement.
Open-source contributor
PresentContributed to OWASP projects including OSHP and Noir, and exploring contributions to projects such as NVIDIA Garak and Agent Memory Guard.
Organising team · KongligCTF 2026
2026Part of the organising team for KongligCTF 2026, the first CTF hosted at KTH.
Volunteer · Cybersweden '26, Cybercampus Sverige
Sept 2026Volunteered at Cybersweden '26, organised by Cybercampus Sverige.
Contributor · Stack Overflow
May 2023 — 2025Top 5% global contributor (1,000+ reputation) in programming and security, reaching 25,000+ developers.
Hackathon particpant, mentor & organiser
2022 — PresentParticipated in and mentored at 30+ hackathons, including Tech Europe Agentic AI Hack and Lovable Hackathon. Co-organised two editions of India's largest student-run hackathon, managing operations for 2,500+ attendees.
Volunteer contributor · CSI Linux
Aug 2022 — May 2024Contributed to the open-source CSI Linux project, improving its OSINT and digital forensics tooling alongside a global community of security professionals.