About Pavan Nallamothu

The record stands at 17 CVEs. Each one started as a flaw in software other people depend on, went through coordinated disclosure, and ended with a published reproduction. Apple, CISA, the NSA, NASA, AutoGPT, yt-dlp, and blueprintUE have all named the reporter. Every entry here links straight to the vendor advisory, so the credit is something you confirm at the source instead of taking on trust.

Building is the other half of the job. Sixty systems tools, written from the ground up in Rust, run from compilers and kernels through databases, browser engines, and security tooling, with two standalone projects alongside them. Working from the lowest level up is how I learn where a design quietly breaks its own assumptions, and all of it ships open source under MIT.

Most of the research lives in one lane: server-side request forgery, and the egress guards meant to contain it. That lane produced EPI-SSRF, a named class in which a guard checks only part of the outbound surface while an alternate path such as SMTP walks past untouched. The paper defining it is open access, and the term carries its own Wikidata concept so it resolves as a real thing rather than a phrase I keep repeating.

Treat this as the canonical profile. The homepage carries the full timeline under Experience and Education, and the verification table carries the receipts.