About
Aadarsh Anand / ScreaMy7
I'm ScreaMy7 to most of the internet, a handle left over from my CS:GO days. I break mobile apps for a living and for fun: by day a security researcher at Appknox, the rest of the time a bug bounty hunter, based in Bengaluru, India.
How I work
Mobile & native
I work an Android app top to bottom — from decompiled Java/Kotlin down to the native.so libraries most testers never open — with Frida, jadx and Ghidra, and I fuzz JNI code with AFL++. Working both layers is where the interesting bugs tend to hide.
Web & API
Mobile is half the job. The other half is the web and API surface those apps talk to, tested against the OWASP Top 10 with Burp Suite, Nuclei and a lot of reading other people's JavaScript — an SPA ships its route map, API calls and client-side permission checks straight to the browser, and most testers skip it. Broken authorisation is what I find most: IDOR and BOLA on endpoints the mobile client was never meant to expose. It's also where my bug bounty work happens.
Tooling
When something is too slow to do by hand twice, I automate it: Semgrep and Androguard rules so patterns get caught without me, and lately agents, fuzzing pipelines and benchmarks that scale the slow parts of testing.
Classes I keep finding
- IDOR / BOLA
- broken authorisation
- insecure cryptography
- IPC abuse
- OWASP Top 10
- MASVS / MASTG
Day to day
- Frida
- jadx
- Ghidra
- Burp Suite
- Semgrep
- Androguard
- Nuclei
- AFL++ frida-mode
- Nmap
- Python
- Bash
Work
Security Researcher, Appknox
Nov 2023 – present200+ end-to-end penetration tests across web, Android/iOS and API targets for enterprise clients in BFSI, fintech and e-commerce — enough to start seeing the same vulnerability classes recur, which is why I write Semgrep and Androguard rules so the scanning platform catches those patterns automatically. Joined as an intern in June 2023 and converted to full-time.
The part that isn't testing: I run remediation calls with client engineering teams, explain root cause and the secure alternative, then validate the fix. A report nobody can act on hasn't fixed anything.
Bug bounty
- $20,000+
- in bounties for vulnerabilities responsibly disclosed to Adobe, Razorpay, AT&T, M&T Bank and Ford.
- Hall of Fame
- from Accenture, the United Nations and Palo Alto Networks.
- Top 60 globally
- in the H@cktivityCon 2021 CTF, web and mobile.
Open source
- OWASP MASTG
- Contributed test cases on Android code security, SSL pinning bypass, IPC hardening and cryptographic flaws.
- Nuclei Templates (ProjectDiscovery)
- CVE detection templates for the community template library.
The tools I've built are on the projects page.
Writing
All posts →- An AI agent in the fuzzing loop: re-finding CVE-2017-11729 in libming
- Check reachability before you fuzz for a CVE
- herdr + omp: my terminal setup for agent-driven security work
Longer writeups on the blog; shorter pieces on how I work in notes.
Contact
zoroanandadarsh@gmail.com · GitHub · LinkedIn
Reporting a vulnerability in something I maintain? See security.txt.