About Pavan Nallamothu

I find vulnerabilities in software that people already run, report them through coordinated disclosure, and publish the reproduction. The published record is 12 CVEs, credited by Apple, CISA, the NSA, AutoGPT, yt-dlp, and blueprintUE. Each one has a page on this site that links the authoritative advisory, so the credit can be checked at the source rather than taken on my word.

My research sits in one lane: server-side request forgery and the guards meant to stop it. That work produced EPI-SSRF, a named class where an egress guard covers only some of the outbound clients, so an alternate path such as SMTP walks past it. The paper that defines it is open access, and the term has a Wikidata concept item so machines can resolve it as a real thing rather than a phrase I repeat.

The rest of my time goes into building the software I break. Sixty systems tools written from scratch in Rust, from compilers and kernels to databases, browser engines, and security tooling, plus two standalone projects. Building a thing from the lowest level up is how I learn where its assumptions fail, and every tool here is open source under MIT.

This page is the canonical profile. The Experience and Education sections on the homepage carry the full record, and the researcher profile carries the receipts.