I build real software,
then spend just as long trying to break it.
I've shipped three working products: RSA broken from scratch and against real quantum hardware, a threshold-signature scheme built from a 2024 paper, and a task app that actually can't read your data. Outside of that, I do CTF work — mostly web and binary exploitation.
Who's writing this
2
3
4
5
6
7
8
9
10
11
12
const developer = { name: "Abhinav Kumar", based_in: "Sydney, Australia", stack: ["Python", "React", "TypeScript", "FastAPI"], security: ["web exploitation", "binary exploitation", "applied cryptography"], philosophy: "understand how it breaks, then build it so it doesn't", currently: shipping("real, working systems") };
Where I've worked
- Validated REST API requests (GET, POST, PUT, DELETE) and authentication flows using API keys and tokens across integration builds.
- Executed SQL queries to validate data integrity and supported data mapping between integrated applications.
- Monitored API responses, identified errors and failures, and assisted in debugging integration issues, contributing to functional and quality-assurance testing cycles.
What I actually use
Projects that ship
RSA cracked three ways: by hand, classically, and on a real quantum computer.
- Built a quantum statevector simulator from scratch and checked it bit-for-bit against Google Cirq
- Ran actual period-finding on IBM quantum hardware, not just a simulator
- Classical factoring attacks benchmarked side by side with the quantum approach
Anyone can claim a quantum simulator is correct. Trusting my own code to grade my own code isn't proof of anything.
Built the statevector simulator from scratch — gates, entanglement, QFT — then ran the same circuits through Google's Cirq and diffed the results state by state, not just eyeballing the output.
Matched Cirq to floating-point precision across multiple configurations. The real IBM hardware run came back noisier, which is exactly the point — the simulator shows the ideal case, the hardware run shows what you actually get today.
A working build of Kelsey, Lang & Lucks' 2024 threshold-signature scheme, not just a write-up of it.
- Winternitz one-time signatures and Merkle trees, no elliptic curves or RSA anywhere
- k-of-n signing demoed across real separate browser tabs over BroadcastChannel
- Every primitive runs live in the browser, computed on the spot, not precomputed
A "multi-party" signing demo is easy to fake — one shared JS array pretending to be three separate signers proves nothing about whether the protocol actually works across parties.
Ran each signer in a genuinely separate browser tab with no shared memory, talking only over BroadcastChannel — the same isolation real separate machines would have.
k-of-n threshold signing works with real message-passing between isolated tabs, and every Winternitz signature and Merkle proof is computed live, not precomputed and just displayed.
A task app that can't read your tasks, and proves it instead of just claiming it.
- AES-256-GCM client-side, key derived via PBKDF2-SHA256 at 600,000 iterations
- No account, works fully offline, nothing readable ever touches the network
- A live "you vs. the server" panel shows exactly what the backend actually sees: ciphertext
"We encrypt your data" is a line every app puts in its privacy policy. Almost none let you actually check it.
Built a "you vs. the server" panel that queries the real stored record and renders exactly what the backend has on disk — instead of asking you to just trust the claim.
What the server sees is ciphertext, full stop. AES-256-GCM with a key derived via PBKDF2-SHA256 at 600,000 iterations means even a compromised backend has nothing readable to leak.
Break some RSA, right here
This factors n and decrypts the ciphertext for real, in your browser — nothing is sent anywhere. It's slow on purpose past a few trillion: that gap between "instant" and "not in your lifetime" is the entire reason RSA works. The prefilled example is a toy 12-bit key; find a stranger one somewhere on this site and paste it in.
Notes from the field
Is it actually up
Poke around a bit
Let's build something
const contact = { name: "Abhinav Kumar", email: "pinku2c@gmail.com", github: "github.com/iabhi92", linkedin: "linkedin.com/in/iabhi92", based_in: "Sydney, Australia" };