- 🛡️ Application Security Engineer specializing in manual penetration testing
- 🐛 Discovered 15+ critical vulnerabilities affecting 5,000+ users
- 🤖 Building Python automation tools for security testing
- 📚 Currently pursuing BCA in Information Technology at D.Y. Patil University
- 🎯 Working towards OSCP certification
- 💡 Creator of 365 Days of Application Security
- 🌱 Active on TryHackMe (65% completion) & Hack The Box (6+ boxes)
- 💬 Ask me about OWASP Top 10, API Security, JWT vulnerabilities
- ⚡ Fun fact: Electronics background → Perfect for IoT/Hardware security!
| 🎯 Achievement | 📊 Metric |
|---|---|
| Critical Vulnerabilities | 15+ Discovered |
| Users Protected | 5,000+ |
| Remediation Rate | 95% |
| Efficiency Gain | 30% through automation |
| Security Debt Reduced | 40% |
| TryHackMe Progress | 65% |
| HTB Boxes Rooted | 6+ |
Complete year-long roadmap from beginner to professional AppSec Engineer
📌 Highlights:
- ✅ Day-by-day structured learning plan
- ✅ 100+ free resources curated
- ✅ OWASP Top 10 complete coverage
- ✅ Certification guides (Security+, eJPT, OSCP)
- ✅ Career preparation included
🔧 Tech Stack: Educational Content · Security Resources · Free Labs
Python-based comprehensive security testing framework for REST APIs
📌 Highlights:
- ✅ JWT Token Analysis & Exploitation
- ✅ IDOR Vulnerability Scanner
- ✅ API Fuzzing Engine
- ✅ Authentication/Authorization Testing
- ✅ CI/CD Integration Ready
🔧 Tech Stack: Python · Burp Suite API · JWT · REST APIs
📈 Impact: 30% reduction in manual testing time
Production-grade secure authentication system with JWT and role-based access control
📌 Highlights:
- ✅ Secure JWT Implementation
- ✅ Granular RBAC System
- ✅ Comprehensive Security Headers
- ✅ Rate Limiting & DDoS Protection
- ✅ OWASP Best Practices
🔧 Tech Stack: Node.js · Express.js · MongoDB · JWT · bcrypt
📈 Impact: 30% fewer vulnerabilities vs industry baseline
Detailed walkthroughs and methodologies from TryHackMe, Hack The Box, and VulnHub
📌 Highlights:
- ✅ Step-by-step enumeration guides
- ✅ Exploitation techniques documented
- ✅ Privilege escalation methods
- ✅ Screenshots and proof
- ✅ Lessons learned section
🎮 Platforms: TryHackMe · HackTheBox · VulnHub
Codec Technologies India | Nov 2025 - Dec 2025
- 🎯 Discovered 15+ critical/high severity vulnerabilities (IDOR, broken authorization, privilege escalation, JWT misconfigurations)
- 📈 Achieved 95% remediation rate through clear PoC exploits and developer collaboration
- ⚡ Reduced analysis time by 30% via Python automation for API fuzzing
- 🛡️ Performed comprehensive authorization testing with Burp Suite Pro
- 📄 Authored professional reports with CVSS scoring
ai4sees private ltd | Dec 2025 - Present
- 🏗️ Designed secure web architecture with OWASP controls
- 🔧 Built reusable REST API libraries reducing vulnerabilities by 30%
- 🔄 Integrated SAST/DAST in CI/CD, reducing security debt by 40%
- ✅ Implemented secure coding: input validation, parameterized queries, session management
- 👨💻 Conducted security code reviews focusing on OWASP Top 10
Codec Technologies India | Nov 2025 - Dec 2025
- 🤖 Developed security automation scripts and API testing tools
- ⏱️ Reduced manual effort by 2+ hours/week through automation utilities
- 📊 Built log parsing, data extraction, and workflow automation tools
- 🔍 Created reusable libraries for API fuzzing and auth analysis
| 🏅 Certification | 🏢 Provider | 📅 Status |
|---|---|---|
| Application Security Training | Various Providers | ✅ Completed |
| Cyber Security Architecture v1 | Various Providers | ✅ Completed |
| Commonwealth Bank - Cybersecurity Simulation | Forage | ✅ Completed |
| AIG - Shields Up: Cybersecurity | Forage | ✅ Completed |
| Deloitte Australia - Cyber Simulation | Forage | ✅ Completed |
| CompTIA Security+ | CompTIA | 🎯 In Progress |
| eJPT | eLearnSecurity | 🎯 Preparing |
| OSCP | Offensive Security | 🎯 Goal 2026 |
- TryHackMe: 65% Junior Penetration Tester Path | 50+ rooms completed
- Hack The Box: 6+ machines rooted | Active member
- PortSwigger Academy: Continuous practice on all vulnerability types
- OWASP Juice Shop, DVWA: Regular practice on intentionally vulnerable apps
📍 Pune, Maharashtra, India
📧 chetanchandrakantbiranje@gmail.com
🔗 linkedin.com/in/chetanbiranje
"Security is not a product, but a process."
— Bruce Schneier
"The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very highly paid armed guards. Even then, I wouldn't stake my life on it."
— Gene Spafford
class ChetanBiranje:
def __init__(self):
self.role = "Application Security Engineer"
self.current_focus = [
"OSCP Certification Preparation",
"Bug Bounty Hunting (Google VRP, HackerOne)",
"Advanced API Security Research",
"Security Automation with Python",
"Contributing to Open Source Security Tools"
]
self.learning = [
"Cloud Security (AWS, Azure, GCP)",
"Mobile Security (Android, iOS)",
"Container Security (Docker, Kubernetes)",
"Active Directory Security"
]
self.goals_2026 = [
"OSCP Certification ✅",
"Land Application Security role at FAANG",
"Contribute to 10+ open source security projects",
"Publish security research papers",
"Reach 1000+ GitHub stars"
]
def say_hi(self):
print("Thanks for visiting! Let's make the web more secure together!")
me = ChetanBiranje()
me.say_hi()