Vivek Sharma

Blue-team security. SOC detections, secret scanning and app hardening, from Bardoli, Gujarat.

Hiring? Read the 60-second version

An offline attacker can try about 10 billion guesses a second against a fast hash.

Press Enter to open the key, CtrlK to jump anywhere
Open to a 6-month internship, Jan 2027

I got into security by breaking my own projects. Now I build the tools and detections that catch those breaks before someone else finds them.

I'm an IT diploma student at N. G. Patel Polytechnic. I built GapScan, an open-source scanner for leaked keys and misconfigured backends, and a home SOC lab where I attack my own Windows machine and write Wazuh rules to catch it. I led security on Conlatus, which placed 1st runner-up at AI Web Gen. I'm looking for a SOC, security operations or AppSec internship, remote or on-site.

Download resume See the work GitHub LinkedIn

Where I'm pointed

What I spend my time on now, and where that's leading.

Areas of interest

SOC and detection engineeringWazuh, Sysmon, ATT&CK
Application securitySecrets, access control, RLS
Network securityFirewalls, ACLs, traffic analysis
IoT securityESP32, MQTT, firmware
HardwarePCB design in KiCad

Goals

Finishing CS50's Introduction to Cybersecurity and adding MQTT with TLS to the ESP32 monitor.

Start a 6-month internship in a SOC or security operations team.

B.Tech in Computer Science (cyber security) through diploma lateral entry.

Work as a detection engineer, writing the rules that catch real attackers.

Case files

Each project written up the way an incident is: what was at risk, what I did about it, and what changed. Tagged with the role it's proof for.

GapScan

Proof for: AppSec, security engineer
D 48 to A+ 98My own site's grade, before and after fixing what GapScan found

The risk

Small sites leak secrets in git history, leave Supabase tables open and ship admin keys in frontend code. Most owners never find out.

What I built

  • Self-hostable scanner for websites, GitHub repos and Firebase/Supabase backends, graded A+ to F in plain language.
  • Full git-history secret scanning via a GitHub App and gitleaks. Only redacted fingerprints are stored.

What changed

  • Links a key leaked in a repo to the live site's backend as one critical finding.
  • SSRF guard on every outbound request, domain-ownership checks and rate limiting.
Try it: find the leakClick the line GapScan would flag
  1. import { createClient } from "@supabase/supabase-js";
  2. const url = "https://xyzproject.supabase.co";
  3. const anon = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
  4. const awsKey = "AKIAIOSFODNN7EXAMPLE"; // temp, remove later
  5. const region = "ap-south-1";
  6. export const db = createClient(url, anon);

One of these lines would get you a critical finding.

FastAPICeleryRedisPostgreSQLNext.jsRead the full write-upOpen repo

Home SOC Lab

Proof for: SOC analyst, detection engineer
140 to 33Idle alerts per hour after 6 tuning rules, about 77% less noise

The risk

Default SIEM setups miss real attacks and bury analysts in noise. I wanted to see both problems first-hand.

What I built

  • 3-VM lab on an isolated network: Wazuh 4.14 on Ubuntu, Windows 11 with Sysmon, Kali as attacker.
  • 7 ATT&CK techniques simulated, 5 custom detection rules written.

What changed

  • 4 detection gaps closed, including a persistence technique that got past Microsoft Defender.
  • Every level-15 false positive removed.
WazuhSysmonKaliMITRE ATT&CKRead the full write-upOpen repo

Conlatus

Proof for: AppSec, security lead
HTTP 403What a normal browser gets. Interviews only open inside Safe Exam Browser

The risk

An AI interview means nothing if the candidate can switch tabs, paste answers or have someone else sit in.

What I built

  • Anti-cheat on a 3-person team: tab-switch detection, gaze tracking with face-api.js, copy-paste blocking.
  • Interviews locked inside Safe Exam Browser with a custom config.

What changed

  • Tested and hardened against prompt injection, IDOR and broken access control.
  • 1st runner-up, AI Web Gen, Vivesmruti at RNGPIT.
FastAPINext.jsSafe Exam Browserface-api.jsRead the full write-up

VaultX

Proof for: AppSec

Zero-knowledge password manager. Credentials are encrypted in the browser with PBKDF2 (600,000 iterations) and AES-GCM, so the database only ever holds ciphertext. Auto-lock and clipboard clearing.

Live demo Repo

ESP32 Climate Monitor

Proof for: IoT security

ESP32 with a DHT11 sensor and a 16x2 LCD in 4-bit mode. MQTT publishing is in progress, and the next step is locking that channel down with TLS and auth.

LinkNest

Proof for: full-stack

Bookmark manager with per-user access rules on Firebase, deployed on Vercel. It uses Google sign-in, so nobody else can read your bookmarks. Built alongside VaultX on the same stack.

Live demo Repo

A scan that never raised an alert

From my SOC lab. Written the way a real report reads, because finding the problem is only half the job.

Scope

My own isolated lab: a Windows 11 endpoint with Sysmon, monitored by Wazuh 4.14, attacked from Kali.

Recon

Ran an Nmap port scan (ATT&CK T1046) against the endpoint and watched the SIEM.

Finding

Wazuh showed nothing. I traced it to two default settings: the Windows audit policy and the Wazuh agent's event filter.

Impact

A real attacker's reconnaissance would have gone completely unseen on a default setup.

Fix

Changed both settings and confirmed the scan now raises an alert. One of the 4 detection gaps I closed.

Full SOC lab write-up Lab repo How GapScan works

What my lab catches

Attacks I ran against my own machine, then wrote or tuned rules to detect. Pick one to replay it.

Simplified replay of what the lab shows. Pick a technique above.

7techniques simulated
5custom rules written
4detection gaps closed
0level-15 false positives left

Toolkit

What I actually use, grouped by the job it does.

Security operations

Wazuh SIEMSysmonWindows Event LogsDetection rulesMITRE ATT&CKAlert triageMicrosoft Defender

Application security

gitleaksSSRF preventionFirebase rulesSupabase RLSSecurity headersSPF / DMARC / CAA

Offense and network

Kali LinuxNmapNetExecWiresharkPacket TracerFirewalls & ACLs

Build and ship

PythonFastAPINext.jsPostgreSQLRedisDockerLinuxPowerShellCloudflare

Milestones

Education, training and competitions, newest first.

Live from GitHub

My most recently updated repositories, pulled from GitHub when you load this page.

Let's talk.

Available for a 6-month SOC, security operations or cybersecurity internship from January 2027. Remote, or on-site in Ahmedabad, Surat, Mumbai, Pune or Bengaluru.

This opens your own email app with the message filled in. Nothing is stored on this site.

LinkedIn/in/viveksharma0502. Updates on projects and the internship search GitHubVivekSharma0502. Code for GapScan and the SOC lab
↑ ↓ moveEnter openEsc close

Vivek Sharma

IT diploma student. Blue-team security. Available from January 2027 for a 6-month SOC, security operations or AppSec internship, remote or on-site.

Download resume LinkedIn