Hi, I'm
Pradyumn Tiware Nexus
Architect of BrahmastraX & Recon Pipeline v2.1 — systems that map attack surfaces before a single payload fires. I blend OSINT, CDX forensics, JS analysis and API mapping into precision-tuned recon engines. Trusted by NASA, BMW, Microsoft, Toyota, ISRO & more. Every bug found. Responsibly disclosed.
Who is PradyumnTiwareNexus?
Pradyumn Tiwari — known online as PradyumnTiwareNexus — is an independent Bug Bounty Hunter and Cybersecurity Researcher from India. His work centers on finding real-world vulnerabilities in web applications and APIs, then reporting them through coordinated, responsible disclosure rather than public exposure.
His research spans Web Application Security, API Security, OSINT, JavaScript Analysis, and Attack Surface Mapping, backed by self-built recon automation tooling that maps a target's exposed surface before any testing begins. Beyond bug bounty, he contributes to open-source security — auditing public repositories and publishing findings as GitHub Security Advisories once maintainers confirm and merge a fix.
That combination — hands-on vulnerability research paired with the tooling to find issues faster — has earned him Hall of Fame recognition from organizations including NASA, Microsoft, Toyota, BMW, Quick Heal, and ISRO, among others. What sets his approach apart is consistency: every acknowledgement on this page reflects a vulnerability that was reproduced, confirmed, and fixed — not just reported.
Research Dashboard
Research Timeline
Hacking is not about breaking things
Pradyumn Tiware Nexus is a Bug Bounty Hunter and Cybersecurity Researcher from India, recognized by NASA, Microsoft, Toyota, Quick Heal, BMW, and ISRO for responsible security research.
I'm Pradyumn Tiware — a Cybersecurity Researcher, Bug Bounty Hunter, and Recon Automation Developer from India. I don't just find bugs. I build the systems that find them for me.
My recon pipelines weave together OSINT, JavaScript analysis, CDX archive forensics, and API endpoint mapping — constructing a razor-sharp picture of any target's attack surface before a single payload fires. Signal over noise. Always.
When I'm not breaking things responsibly, I'm competing in CTFs, building tooling that the community actually needs, and documenting every finding that makes the internet a little safer.
My Arsenal
Research Methodology
The pipeline every finding on this page passes through before it becomes a Hall of Fame entry, certificate, or GitHub Security Advisory.
🏆 Hall of Fame
Official Hall of Fame acknowledgements earned through responsible disclosure — from global automotive giants and space agencies to cybersecurity leaders. Every disclosure. Coordinated. Ethical. Impactful.
→ Critical security flaw in BMW's digital infrastructure
→ Coordinated via Intigriti Bug Bounty Platform
→ Security vulnerability in NASA's web systems
→ Coordinated via Bugcrowd Vulnerability Disclosure
→ Security flaw reported to Microsoft MSRC
→ Direct coordinated disclosure process
→ Security vulnerability in Toyota's systems
→ Responsible disclosure via Bugcrowd platform
→ Security flaw in Quick Heal's infrastructure
→ Direct private coordinated disclosure
→ Security issue in ISRO's digital systems
→ Private coordinated disclosure 🇮🇳
→ Session management vulnerability
→ Security issue responsibly disclosed
→ Official Hall of Fame recognition
→ Multiple security findings
→ Coordinated vulnerability disclosure
→ Official Security Hall of Fame
→ Security vulnerability reported
→ Coordinated disclosure with BSNL
→ Helping strengthen telecom security
→ Security vulnerability reported
→ Official Hall of Fame recognition
→ Responsible coordinated disclosure
→ Security vulnerability responsibly reported
→ Listed on Whir's public Security Acknowledgments page
Additional Recognitions
📜 Appreciation & Certificates
Letters of appreciation, responsible disclosure certificates, and acknowledgement pages issued directly by organizations for reported findings.
→ Low-severity vulnerability on Devsly (devsly.io)
→ Issued Jul 23, 2026 · Devsly Security Team
→ Info-severity vulnerability on Devsly (devsly.io)
→ Issued Jul 24, 2026 · Devsly Security Team
→ Info-severity vulnerability on Devsly (devsly.io)
→ Issued Jul 24, 2026 · Devsly Security Team
→ Low-severity vulnerability on Devsly (devsly.io)
→ Issued Aug 15, 2026 · Devsly Security Team
Letter of Appreciation received from LG, shared publicly on LinkedIn.
🚀 Open Source Security Contributions
Helping improve open-source software through responsible security research, code review, and collaboration with maintainers.
Tools I've Built
An advanced cybersecurity platform engineered for multi-stage recon, exploitation, and automation. Combines intelligent attack surface discovery with structured automation workflows — purpose-built for professional researchers and bug bounty hunters.
Explore Live →URL Manager for Pentesters — organize, track, and manage target URLs and endpoints during penetration testing engagements. Clean, fast, and focused on workflow efficiency.
Open Tool →Full-cycle automated recon orchestration — from subdomain discovery to nuclei target generation in a single pipeline. Built for speed and accuracy at scale.
GitHub →Modular scripts for OSINT, JS endpoint extraction, and CDX archive forensics. High-signal output, minimum noise. Each module is standalone and composable.
GitHub →Capture The Flag
Recent Research
Let's Connect
I work strictly within vendor bounty programs and follow coordinated disclosure guidelines. Open to legitimate research collaborations, tool discussions, and security-related inquiries from like-minded professionals. No grey-hat. No drama. Just results.