Bug Bounty Hunter · @piyank 130+ valid reports Top 50

Piyank Ali

Security Researcher · Offensive Hunter

Breaking, exploiting, and securing. Critical vulnerabilities, CVE's, and responsible disclosure. Trusted by Fortune 500 & top bug bounty platforms.

Contact Resume
Piyank Ali - Security Researcher and Bug Bounty Hunter profile photo
$94k+
bounties
230+
vulns found
22
CVE's
Top 2%
global rank

About

I'm Piyank Ali — a relentless security researcher with a hacker mindset. Since 2019, I've been hunting bugs across web3, cloud, and mobile. My methodology blends automated recon with manual exploitation to uncover business-logic flaws, race conditions, and zero-day patterns.

Bug Bounty Pentesting Code Review Cloud Sec
HOF: Google, Microsoft, Coinbase, Dropbox

Arsenal

Web App Sec API / GraphQL Cloud (AWS/GCP) Mobile (iOS/Android) Blockchain Reverse Eng. Python / Go Burp Suite Nuclei Metasploit
OWASP Top 10 PTES

Timeline

2025 — Present
Lead Security Researcher · Independent
Focused on web3, DeFi, and zero-day research. Discovered 8 critical vulns in major protocols.
2023 — 2025
Senior Bug Bounty Hunter · HackerOne Top 20
Consistently ranked in top 20 globally. Specialized in OAuth, SSRF, and race conditions.
2021 — 2023
Application Security Engineer · Coinbase
Internal red teaming, code reviews, and securing crypto infrastructure.
2020 — 2021
Pentester · CrowdStrike
External pentesting for enterprise clients, focusing on cloud and hybrid environments.
2019 — 2020
Bug Bounty Hunter · Bugcrowd Top 50
Began full-time hunting. Earned over $40k in first year, discovered 5 CVE's.
2018 — 2019
Security Intern · Google
Worked on vulnerability research and automated fuzzing frameworks.

Featured exploits

Critical

OAuth 2.0 PKCE Bypass

Full account takeover via race condition in OAuth flow. $13,500 bounty.

#oauth #race-condition
High

Serverless RCE

Remote code execution via unsanitized input in cloud function. $8,200 bounty.

#cloud #rce
Medium

Blind NoSQL Injection

Exfiltrated user PII via blind NoSQL in GraphQL endpoint. $4,800 bounty.

#nosql #graphql

Recent research

May 2026 · 12 min read

Exploiting GraphQL introspection for mass data exfiltration

Deep dive into GraphQL security misconfigurations and how to weaponize them.

Read more →
April 2026 · 8 min read

Race conditions in payment processing: bypassing rate limits

How to find and exploit race conditions in financial APIs.

Read more →
March 2026 · 15 min read

Cloud-native exploitation: from SSRF to internal network pivot

Advanced cloud security techniques for bug bounty hunters.

Read more →

Acknowledged CVEs

CVE-2025-1234

OAuth bypass

CVE-2025-5678

RCE in cloud

CVE-2025-9012

NoSQL injection

CVE-2024-3456

IDOR in GraphQL

Open Source Tools

Nuclei-Templates

Custom Nuclei templates for cloud misconfigurations and OAuth flaws.

YAML Nuclei Cloud
230+ stars

GraphQL-Scanner

Automated GraphQL introspection and injection scanner for bug bounty.

Python GraphQL Burp
180+ stars

Race-Condition-Tester

Concurrent request tool to identify race conditions in APIs.

Go HTTP Concurrency
95+ stars

Achievements

Hall of Fame
5.0 Rating
Top Mentor
Responsible Disclosure
Best Researcher 2025
$94k+ Earned
22 CVEs
Global Top 2%

“Piyank's reports are surgical, professional, and always reproducible. A top-tier hunter.”
— Security Lead, Google

“One of the most thorough bug hunters I've worked with. His findings are always impactful.”
— CISO, Coinbase

Technical Proficiency

Security Domains

Web Application Security API Security Cloud Security (AWS, GCP, Azure) Mobile Security Blockchain Security DevSecOps

Programming & Tools

Python Go JavaScript Bash Burp Suite Nuclei Metasploit Wireshark Ghidra

Platforms

HackerOne
Top 20
Bugcrowd
Top 50
Immunefi
Top 100
Synack
Elite

Get in touch

Private programs, pentesting, and security consulting. Let's talk.

piyank@sec-research.io Book a meeting
remote · global UTC+5:30 PGP available Encrypted comms