fa1c0n

india · apac

Role

security researcher

Discipline

internet recon

I scan the internet for things people forgot were public — exposed APIs, leaking source maps, open inference endpoints, misconfigured infra — and write up what I find.

Currently focused on India's attack surface and on building tooling that uses AI as a reasoning layer, not a scanner.

Browse research →Articles →Send signal

scope · activerange /0tgt: in.surfacerev 04

Now · reconSweeping public OpenAPI / Swagger exposure across India · APAC ranges.

Now · pipelineWhen maps leak: rebuild clients, trace generated API calls, flag bulk-style routes.

Now · labAI-Hack-OS — clustering recon output so prioritisation isn't guesswork.

Now · complianceMapping findings into DPDP · ISO 27001 language for accountable disclosure.

Now · reviewTracing trust boundaries — bulk access & IDOR-class paths get a human pass.

Now · reconSweeping public OpenAPI / Swagger exposure across India · APAC ranges.

Now · pipelineWhen maps leak: rebuild clients, trace generated API calls, flag bulk-style routes.

Now · labAI-Hack-OS — clustering recon output so prioritisation isn't guesswork.

Now · complianceMapping findings into DPDP · ISO 27001 language for accountable disclosure.

Now · reviewTracing trust boundaries — bulk access & IDOR-class paths get a human pass.

SCOPE India / APAC attack-surface work — active·CASE/001 India's Swagger Problem — 1,284 OpenAPI specs · ~38% routes without declared auth·DROP brief filed 11 May 2026·FINDING Bulk sensitive-data exposure surfaced through AI-assisted bounty recon — manually validated end-to-end·LAB AI-Hack-OS — active development; POC showing strong results on attack-surface mapping & prioritisation·SCOPE India / APAC attack-surface work — active·CASE/001 India's Swagger Problem — 1,284 OpenAPI specs · ~38% routes without declared auth·DROP brief filed 11 May 2026·FINDING Bulk sensitive-data exposure surfaced through AI-assisted bounty recon — manually validated end-to-end·LAB AI-Hack-OS — active development; POC showing strong results on attack-surface mapping & prioritisation·

/02

Dossier

— operator file · classified // open-source

FILEOPERATOR · fa1c0n// rev 04

FILE-001

Codename

fa1c0n

// brief

Independent security researcher focused on India and internet-scale reconnaissance, exposure analysis, scanning, building tooling, and publishing what surfaces.

My research targets India's digital attack surface — enormous, fast-growing, largely understudied. Most researchers focus on US/EU. I'm interested in what's happening here.

I build tools to automate the boring parts of recon so I can spend more time on the parts that need human reasoning. Current project — AI-Hack-OS — is an attempt to use AI as a reasoning layer over raw recon, not as another scanner.

If something I publish is useful to you — or wrong — I want to hear about it.

internet-scale recon EXP

attack surface mgmt EXP

api / openapi audit EXP

js + source map analysis ADV

ai-assisted hunting ADV

cloud exposure ADV

bug bounty automation ADV

technical writing EXP

fa1c0n

Research briefs

India's Swagger Problem — production APIs leaking authenticated routes to anyone with a browser

Dossier

// brief

Send a signal.
I read everything.

fa1c0n

Research briefs

India's Swagger Problem — production APIs leaking authenticated routes to anyone with a browser

Dossier

// brief

Send a signal.I read everything.

Send a signal.
I read everything.