Gouthaman G — Application & API Security Engineer

Flagship Tooling OWASP API Top 10

Aegis-API: Multi-Protocol API Security Testing Framework

Python 3.9+ · REST / SOAP / GraphQL · Docker · GitHub Actions

A comprehensive, automated API penetration testing framework engineered to validate REST, GraphQL, and SOAP microservices end-to-end. Features automated protocol routing, OpenAPI/Swagger contract parsing, and active vulnerability probing against intentionally vulnerable enterprise labs (crAPI, DVGA).

Two-User Tri-Request Engine: Implements state-differential analysis across CRUD operations, sub-resources, and parameter manipulation to detect Action-Level BOLA & IDOR with zero guesswork.
State Verification Engine: GET-PUT-GET state verification confirming real mass assignment bugs on production-like endpoints.
JWT & Rate-Limit Probing: Automated verification of alg:none, algorithm confusion, weak secret bruteforcing, kid header injection, and burst/throttle threshold bypasses.
GraphQL & SOAP Probing: AST query-depth exhaustion, field-level auth bypass, batching credential stuffing, in-band XXE file disclosure, and XML injection.
CI/CD DevSecOps Gate: Automated FIRST CVSS v3.1 dynamic scoring, auto-generated PDF/CSV reports, and GitHub Actions pass/fail thresholds.

Python GraphQL AST LXML / SOAP CVSS v3.1 Docker GitHub Actions

View Repository on GitHub →

aegis_bola_engine.py TRI-REQUEST PROTOCOL

# Step 1: User_A creates resource
res_a = user_a.post('/api/orders', data={'item': 'id_42'})
target_id = res_a.json()['id']

# Step 2: User_B attempts direct cross-tenant GET
probe = user_b.get(f'/api/orders/{target_id}')

# Step 3: State-differential similarity analysis
if probe.status_code == 200:
    sim_ratio = compare_bodies(res_a.body, probe.body)
    if sim_ratio > 0.92:
        raise BOLAIncident(
            severity='HIGH',
            cvss_score=8.6,
            evidence=probe.text
        )
          

Public Project Enterprise Web AppSec OWASP A01:2021 Specialist

Aegis-Web: Multi-Role Access-Control Testing Platform

FastAPI · PostgreSQL 16 · React 19 SPA · TypeScript 5.x · Playwright Chromium · Async Worker Queue

A public, enterprise-grade automated security assessment platform engineered specifically to detect and verify OWASP A01:2021 (Broken Access Control) in modern web applications and APIs. Conventional DAST scanners routinely miss access control flaws because they evaluate requests in isolation without tenant or privilege context. Aegis-Web solves this by recording genuine authenticated user sessions using Playwright Chromium across distinct roles, normalizing dynamic responses, and executing automated cross-role differential replays with mathematically grounded similarity scoring and strict false-positive suppression.

Headless Playwright Chromium Crawler: Authenticates across multi-tier accounts (Admin, Auditor, Standard User) and records authentic DOM routes and state-mutating API calls.
Cross-Role Differential Replay Engine: Executes automated cross-role replays across privilege boundaries to flag Horizontal IDOR, Vertical Privilege Escalation, and Unauthenticated Access with normalized response body comparisons.
Queue Architecture: High-performance FastAPI backend enqueues jobs to PostgreSQL 16 using FOR UPDATE SKIP LOCKED with an async background worker runner.
React 19 DiffViewer Dashboard: Full single-page application presenting visual diffs, Levenshtein & sequence similarity scoring, and false-positive suppression controls.

TypeScript 5.x React 19 FastAPI PostgreSQL 16 Playwright httpx Docker

View Public Repository on GitHub →

aegis-web/worker/differential.py CROSS-ROLE REPLAY

# Worker claims next queued scan job safely
SELECT * FROM scans 
WHERE status = 'queued' 
FOR UPDATE SKIP LOCKED LIMIT 1;

# Replay low-priv user request with Admin session
resp_admin = await client.request(
    method=orig_req.method,
    url=orig_req.url,
    headers=auth_headers_admin
)

if resp_admin.status_code == 200:
    raise VerticalPrivilegeEscalation(
        endpoint=orig_req.url,
        severity='CRITICAL',
        diff=diff_bodies(orig_resp, resp_admin)
    )
          

Planning Stage 6-Phase Architectural Roadmap Zero-Cost Free AI Stack

Helm: Autonomous AI Cyber Copilot & Career Orchestrator

Python 3.11 · Google Gemini (Free Tier) · Groq API · Playwright · Streamlit · Telegram Bot

An autonomous personal operating system and career copilot architected specifically for cyber security professionals. Designed to operate completely on free-tier AI (Google Gemini Free API with Groq as high-speed fallback) while maintaining strict compliance with platform rules through human-in-the-loop safeguards (automating the 90% prefill burden while safely pausing before the final Submit click).

v1 — Core & Cyber Job Engine: Gmail alert parsers across LinkedIn, Naukri, Internshala, Instahyre, and Wellfound; strict cyber-role filtering; semantic scoring (0–10) against user credentials via Gemini Free API; Streamlit dashboard & Telegram morning digest with 7-day follow-up reminders.
v2 — Multi-Source ATS & TOS-Compliant Prefill: Ingestion of Greenhouse, Lever, and Ashby feeds; automated resume tailoring and cover notes (zero hallucinated skills); Playwright browser prefill that populates form fields but safely pauses before Submit to protect platform account standing.
v3 — Network Outreach & Interview Intel: Curated directory of recruiters, security engineers, and alumni with AI message drafting (sent manually), reply tracking, and automated company threat briefs before interviews.
v4 — Security Knowledge & Lab Pipeline: Converts Obsidian markdown vaults into spaced-repetition flashcards, delivers automated daily CVE/advisory digests, and tracks CTF and PortSwigger lab write-ups.
v5 & v6 — Operations, Verification & Backups: Integrates trading journal rule-break checks, conducts automated Git secret leakage audits, and provisions nightly encrypted backups of study vaults.

Python 3.11 Gemini Free API Groq API Playwright Streamlit Telegram API Gmail API SQLite

⚡ In Planning Stage · 6-Week Iterative Rollout

helm/core/job_engine.py TOS-COMPLIANT AI FLOW

# v1: Gemini Free API Semantic Scorer
score, reason = await gemini.score_role(
    candidate_profile=load_profile('pure_cyber.json'),
    job_description=alert.text,
    filter_cyber_only=True
)

# v2: Playwright Prefill with Human-in-the-Loop
if score >= 7.5:
    await form_filler.prefill_inputs(page, candidate_profile)
    # Strictly adhere to platform rules: Never auto-submit
    await page.pause_for_human_review(
        prompt="Form prefilled. Check & click Submit!"
    )
          

Final Year Research Active Development

Schema-Aware Zero-Trust Gateway for GraphQL BOLA

GraphQL AST · Zero-Trust Architecture · Python · Ownership Enforcement

An in-line security proxy that blocks Broken Object Level Authorization (BOLA) at the schema level before queries reach downstream resolvers. Eliminates reliance on individual developers remembering to implement authorization checks inside nested resolvers.

Schema Argument Inspection: Intercepts incoming operations, inspects object ID arguments, and enforces tenant ownership validation prior to execution.
AST Canonicalization: Parses and normalizes incoming GraphQL abstract syntax trees, resolving aliases and inline fragments to foil obfuscated bypass attempts.
Anti-Enumeration Rate Limiting: Enforces operation-cost and depth limits to neutralize batched queries attempting high-speed ID enumeration.

GraphQL AST Zero Trust Reverse Proxy BOLA Prevention Rate Limiting

Final Year Project (Amrita Vishwa Vidyapeetham)

gateway/ast_validator.py AST NORMALIZATION

# Parse GraphQL AST to sanitize alias tricks
ast = parse(incoming_query)
visitor = CanonicalizeVisitor()
normalized_query = visit(ast, visitor)

# Validate ownership before resolver execution
for node in visitor.extracted_nodes:
    if not verify_owner(user.id, node.object_id):
        return GraphQLError("Unauthorized Field Access")
          

Scan-as-a-Service Full-Stack AppSec

SentinelGuard / SentinelAPI: Full-Stack API Vulnerability Platform

FastAPI · React + TypeScript · SQLAlchemy · Streamlit · SQLite

A scan-as-a-service application built to detect OWASP API1 (BOLA/IDOR) and API3 (Mass Assignment) via state-verified testing. Features a dual-frontend architecture for both web clients and internal operator consoles.

Dual Frontend: Clean Vite-scaffolded React+TS interface alongside a direct Streamlit console for local analyst inspections.
State Diffing Engine: Leverages SequenceMatcher similarity metrics to identify unauthorized object retrieval with high precision.
Persistence: Normalizes findings, CVSS metrics, and request/response artifacts into a structured SQLite database via SQLAlchemy.

FastAPI TypeScript React SQLAlchemy Streamlit

View Repository on GitHub →

sentinelapi/db.py FINDINGS MODEL

class Finding(Base):
    __tablename__ = "findings"
    id = Column(Integer, primary_key=True)
    scan_id = Column(Integer, ForeignKey("scans.id"))
    vuln_type = Column(String(50))  # BOLA / Mass Assignment
    endpoint = Column(String(255))
    cvss_score = Column(Float)
    evidence_dump = Column(JSON)
          

Systems & Network Defense

Network Intrusion Prevention System (NIPS)

Python · Scapy · Linux iptables · Packet Inspection

A real-time network defense tool that inspects raw packets at the socket level and enforces blocking decisions dynamically through Linux iptables.

Packet Inspection: Real-time capture and decoding with Scapy to identify malicious transport & application payloads.
Signature Rules: Custom detection engine flagging ICMP/UDP/SYN floods, SQLi patterns, XSS tags, and path traversal strings.
Dynamic Firewall Blocking: Automatically provisions dynamic iptables DROP rules against abusive IP addresses.

Scapy iptables Python Network Analysis

View Repository on GitHub →

nips/firewall_block.py IPTABLES MITIGATION

# Execute dynamic iptables drop
subprocess.run([
    'iptables', '-A', 'INPUT',
    '-s', attacker_ip,
    '-j', 'DROP'
], check=True)
logger.warning(f"BLOCKED IP {attacker_ip} [SYN FLOOD / SQLi]")
          

Application Security Engineer focused on Modern APIs & Access Control.

Securing modern applications by understanding the mechanics of access control.

Three pillars of offensive & defensive AppSec

Multi-Protocol API Security

Broken Access Control (BAC)

Schema Gateways & CI/CD Gates

Security systems built to find, prove, & remediate.

Aegis-API: Multi-Protocol API Security Testing Framework

Aegis-Web: Multi-Role Access-Control Testing Platform

Helm: Autonomous AI Cyber Copilot & Career Orchestrator

Schema-Aware Zero-Trust Gateway for GraphQL BOLA

SentinelGuard / SentinelAPI: Full-Stack API Vulnerability Platform

Network Intrusion Prevention System (NIPS)

PortSwigger Web Security Academy Write-Ups

Documentation with Fixes

AppSec capabilities & technology stack

Application & API Security

Offensive & Analysis Tools

Engineering & DevSecOps

Certifications & academic background

Certified API Security Analyst (CASA)

Practical Junior Penetration Tester (PJPT)

Cisco Ethical Hacker

Cisco Networking Fundamentals

Amrita Vishwa Vidyapeetham, Coimbatore