Earlier this year I ran a responsible-disclosure security assessment against a public-facing Government of Tamil Nadu platform — StartupTN, the state's official Startup and Innovation Mission. A few weeks ago, that work turned into a formal Letter of Recognition from their team.
The process was straightforward but deliberate: identify security issues using standard OWASP methodology, report them privately and responsibly rather than disclosing anything publicly, and then work directly with StartupTN's technical team through remediation — verifying each fix before considering the issue closed.
I'm not going to detail the specific vulnerabilities here. That's the whole point of responsible disclosure — the goal is a safer platform, not a write-up. What I can share is the letter itself, signed by Nikunj Panchal, Associate Vice President of TANSIM (StartupTN), recognizing the disclosure, the cooperation during remediation, and the verification work that followed.
Security research has always been an extension of the same curiosity I bring to building software: understanding how a system actually behaves, not just how it's supposed to behave. Getting that recognized by a government innovation mission was a genuinely good moment.
