Research & About
Cybersecurity & networking researcher. I design automated vulnerability-discovery systems whose safety constraints are structural.
About
I'm a Master's-by-research student in cybersecurity and networking, based in Nepal. I spend
my time at the intersection of security automation and the engineering of restraint: how do
you build a system that finds flaws efficiently and is provably unable to overstep
its authorization? Outside the thesis I participate in the security community under the alias
Reck1ess.
Research program
Automated and AI-assisted vulnerability discovery is advancing faster than the control story around it. Most tooling optimizes for detection capability and treats authorization, scope, and blast-radius as operational concerns handled by the operator. My thesis argues the opposite: safety should be a first-class, engineered property of the system.
How can an automated vulnerability-discovery system be designed so that its safety constraints are structural — enforced by the architecture itself — rather than relying on operator discipline or post-hoc policy?
The safety rails
- Authorization gating — nothing runs against a target without an explicit, checkable authorization.
- Scope enforcement — the engine physically cannot reach outside declared scope.
- Blast-radius & rate control — bounded, observable impact.
- Verification before report — findings are validated, not just asserted.
- Kill-switch — a single, reliable stop.
- Tamper-evident audit — every action is accountable after the fact.
How it's studied
All experimentation runs against self-owned or explicitly authorized, reproducible lab targets — never live or third-party systems. The research measures the trade-off between how strict the rails are and how much discovery coverage you keep: the real cost of being safe. Weaponizable exploit code and detection-evasion techniques are explicit non-goals and are not published.
Full proposal available on request — problem, contribution, methodology, evaluation plan, ethics, and an ~18-month timeline.