Meet Vedant Shrivastava, Nisarga Adhikary, and Sarthak Sidhant ,they exposed CBSE in every possible way :
17 years old Vedant Shrivastava :
> Applied for the CBSE re-evaluation process
> Got a different Physics answer sheet
> Posted it on X
> Got labelled "Pakistani" by the BJP IT cell
> Brought CBSE to its knees and proved them wrong
19 years old Nisarga Adhikary :
> Bro hacked the CBSE website
> Reported the vulnerability to them
> But they didn't take any action
> Then bro posted it on X
> Showed everyone that it could be hacked
18 years old Sarthak Sidhant :
> Bro exposed a CBSE tender
> Took it to X
> Wrote a detailed thread
> Explained how the CBSE OSM tender conditions allegedly favoured COEMPT
> And today came on the media
> Exposed them with facts
These three boys are doing what whole media failed to do, all of them took x to expose CBSE .
This is an unbelievable piece of work by Sarthak and something that requires amplification.
Let me explain what he found, in simple terms.
Sarthak is a Class 12 student from the 2025-26 batch, one of the 17 lakh students whose answer sheets went through CBSE's new On-Screen Marking system.
He spent days reading through CBSE's evaluation tenders, scraped all 576 tenders CBSE has issued, and tracked how the rules changed across three versions of the same tender.
The core finding is that the company that won the contract to scan and grade 17 lakh students' answer sheets is Coempt Eduteck.
Coempt used to be called Globarena Technologies. Globarena was the company behind the 2019 Telangana intermediate exam disaster, where software failures led to 3.8 lakh students getting wrong or missing marks, and 23 students died by suicide.
A government committee found systemic failure and negligence. Six months later, Globarena rebranded to Coempt Eduteck.
So a company with that track record won a contract to handle 17 lakh CBSE students. Sarthak's investigation is about how the rules were rewritten to let that happen.
The tender was issued three times.
> First tender, February 2025. It existed, then disappeared from the public GeM portal. Sarthak scraped all 576 CBSE tenders and this one was missing from the archive entirely.
> Second tender, May 2025. Four companies applied including TCS and Coempt. All four failed the technical evaluation. Cancelled.
> Third tender, August 2025. Coempt won. Between the second and third tender, a series of rule changes happened, and every single one made it easier for Coempt to qualify.
Here is what changed, one by one.
01. The old rules disqualified any company with a history of abandoning work, failing to complete contracts, or financial weakness. The new rules deleted this clause entirely. Coempt's Telangana history stopped being a barrier.
02. The old rules disqualified any company that was "blacklisted earlier." The new rules changed this to "currently blacklisted." Because Globarena rebranded after Telangana, removing the word "earlier" effectively erased their past.
03. The rules required Rs 50 crore average turnover over three years. Coempt's exact average came to Rs 50.86 crore. They cleared the bar by less than 1%. Earlier, a smaller company had asked CBSE to lower the bar to Rs 30 crore for fairer competition. CBSE refused. So the bar was kept high enough to block small players, but sat exactly low enough for Coempt to scrape through.
04. Software maturity is measured on the CMMI scale, 1 to 5. The old rules required Level 5. The new rules dropped it to Level 3. Coempt is a Level 3 company.
05. The cooling-off period for engaging retired CBSE officials was cut from two years to one. This makes it easier to use recently retired insiders to influence the process.
06. The old rules required experience with large projects of at least 5 lakh students each. The new rules removed the student count and counted cumulative answer-book volume across small projects instead. Coempt has many small fragmented university contracts. This helped Coempt and hurt TCS.
07. The old rules required bidders to own their own data centre and disaster recovery centre on Indian soil. The new rules allowed third-party MeitY-empanelled cloud hosting. Coempt runs on AWS and Azure. This helped Coempt and hurt TCS, which owns its own data centres. It also means student data is no longer on sovereign, Indian infrastructure.
08. The old rules required the bidder to own or control the complete source code of its software. The new rules deleted this. Coempt's platform runs on Microsoft's proprietary IIS, which they don't own.
09. A last-minute corrigendum, issued right before bid submission, removed CBSE's own power to blacklist the firm if its software failed catastrophically. So even a Telangana-scale failure couldn't get Coempt banned from future government tenders.
10. The penalty structure shifted from punishing mistakes to punishing delays. The old rules fined the vendor for wrong scanning, merged pages, and unscanned books. The new rules dropped those and instead levied Rs 50,000 per day for delays. This incentivises rushed scanning over accurate scanning.
11. The old rules had a hard accuracy threshold, error rate not to exceed 0.5%. The new rules removed this number entirely.
12. The old rules specified proper book and robotics scanners. The new rules just say "sufficient scanners." The definition was vague enough that, as Sarthak notes, the scanning could be done with a phone on a stand.
13. On the security side, the contract required a VAPT (vulnerability and penetration test) certified by CERT-In before go-live, and a restricted beta phase before launch. The system clearly wasn't restricted, because the other researcher, Nisarga, was able to access it and find vulnerabilities four days before go-live. So the mandatory security audit appears to have been bypassed.
These are more than a dozen rule changes, all between the failed tender and the winning tender, all pushing in the same direction, all benefiting the one company with the worst track record in the field.
The security holes Nisarga found last week now have an explanation. The system was built by a vendor that was specifically allowed to skip the security certification, the source code ownership, the data sovereignty, and the quality thresholds the original rules demanded.
Following things need to happen immediately;
1. An immediate CAG audit of the tender process.
2. A parliamentary debate on the topic.
3. An independent investigation into
> Why the first tender vanished?
> Why the disqualification clauses were deleted?
> Why the turnover bar was held exactly where it was?
> Why the security level was dropped?
> Why the blacklisting power was removed at the last moment?
Sarthak, this is genuinely exceptional investigative work. Far better than most journalists with full resources ever manage. Take a bow. :)
Sent the below note to my team in December after spending 2 weeks in SF. Sharing it here as it is still true after a quarter of the year in 2026.
———
hey all concluded my 2 weeks in San Francisco, here are few things I have observed & learned:
Company building:
1. The company building and nature of entrepreneurship has changed. Every founder I spoke to seemed to be on the edge because this technology is changing in 6-8weeks cycle. In their previous start-up gigs the cycles were 12 months or at the max 6months if you are building a consumer.
2. Every start-up is trying to find its Product Market Fit once every 8 weeks. PMF can't be taken for granted until the pace of innovation stalls.
Folks are a lot more aggressive than I saw back in 2016.
3. There is a lot of hype & vaporware too
4. Feels like every software market is crowded and there are 200+ variants of the same thing. There is no new, unique idea unless you attempt to do something very hard in hardware.
5. Companies are getting to $10m revenue in 2yrs. Which is unheard of for a SaaS product.
User Behavior patterns:
1. Users are inherently hungry to try anything AI. They don't know why they are trying, but they want to try anything new.
2. Everyone is trying 3-4 tools for the same use case because they feel one day X is good, the next day X sucks, Y is awesome. I haven't seen such mood swings in user adoption with SaaS or any consumer products sofar.
3. Fast-growing companies are just giving freehand to employees to pick their own tools to do their job and grind more. Product Led Growth is having a resurgence.
People are a lot more open to meeting in person; you can just gate-crash into their office. That is how we got new logos.
4. Users are never satisfied with any AI. Looks like there is a lot of opportunity ahead.
What does this all mean for us as builders:
1. We need to be agile and be on top of the latest tech to experiment/implement into the product.
2. We need to stay very close to the customers/users. That is the only thing that will give a lot of edge. I'm relocating to SF for 1 month, before making any permanent decisions.
3. After a long time, the advantage has quietly tilted towards companies churning the best product instead of companies having the best sales teams. This is the opening we have.
4. Our competitors & peers are working super hard and that demands a certain kind of hard work from us too. I don't think smart work alone cuts it in this cycle of building start-up.
On a personal note, I thought we were in an AI bubble. But after spending 2 weeks, I think we are all collectively building the foundation to live in a world of abundance. Certain sections of society and the working class (tech) are already in AI abundance. It is true that the future is already here it is not evenly distributed.
I feel we will see this abundance-driven market growth for some time and maybe this is the new normal.
Had lots of fun in bringing back a 10 year-old iPod to life. It's amazing to see the craft in this device, the interface still remains fresh and was intuitive for my 7 year-old kid!
Folks, over the last couple of weeks, I built OpenLoom: an open source screen recorder that lives entirely on your own Supabase account.
The Chrome extension setup will now require a couple additional steps (submission to web store is in review).
Building in the open and would love early feedback from anyone who's felt the same itch. (RT for good karma)
https://t.co/YN2jQxBp8s
On DeepWiki and increasing malleability of software.
This starts as partially a post on appreciation to DeepWiki, which I routinely find very useful and I think more people would find useful to know about. I went through a few iterations of use:
Their first feature was that it auto-builds wiki pages for github repos (e.g. nanochat here) with quick Q&A:
https://t.co/DQHXagUwK0
Just swap "github" to "deepwiki" in the URL for any repo and you can instantly Q&A against it. For example, yesterday I was curious about "how does torchao implement fp8 training?". I find that in *many* cases, library docs can be spotty and outdated and bad, but directly asking questions to the code via DeepWiki works very well. The code is the source of truth and LLMs are increasingly able to understand it.
But then I realized that in many cases it's even a lot more powerful not being the direct (human) consumer of this information/functionality, but giving your agent access to DeepWiki via MCP. So e.g. yesterday I faced some annoyances with using torchao library for fp8 training and I had the suspicion that the whole thing really shouldn't be that complicated (wait shouldn't this be a Function like Linear except with a few extra casts and 3 calls to torch._scaled_mm?) so I tried:
"Use DeepWiki MCP and Github CLI to look at how torchao implements fp8 training. Is it possible to 'rip out' the functionality? Implement nanochat/fp8.py that has identical API but is fully self-contained"
Claude went off for 5 minutes and came back with 150 lines of clean code that worked out of the box, with tests proving equivalent results, which allowed me to delete torchao as repo dependency, and for some reason I still don't fully understand (I think it has to do with internals of torch compile) - this simple version runs 3% faster. The agent also found a lot of tiny implementation details that actually do matter, that I may have naively missed otherwise and that would have been very hard for maintainers to keep docs about. Tricks around numerics, dtypes, autocast, meta device, torch compile interactions so I learned a lot from the process too. So this is now the default fp8 training implementation for nanochat
https://t.co/3i5cv6grWm
Anyway TLDR I find this combo of DeepWiki MCP + GitHub CLI is quite powerful to "rip out" any specific functionality from any github repo and target it for the very specific use case that you have in mind, and it actually kind of works now in some cases. Maybe you don't download, configure and take dependency on a giant monolithic library, maybe you point your agent at it and rip out the exact part you need. Maybe this informs how we write software more generally to actively encourage this workflow - e.g. building more "bacterial code", code that is less tangled, more self-contained, more dependency-free, more stateless, much easier to rip out from the repo (https://t.co/iKJUoHiIpl)
There's obvious downsides and risks to this, but it is fundamentally a new option that was not possible or economical before (it would have cost too much time) but now with agents, it is. Software might become a lot more fluid and malleable. "Libraries are over, LLMs are the new compiler" :). And does your project really need its 100MB of dependencies?
They say a mountain decides when someone can reach it's summit. And, the majestic Kedarkantha in Uttarakhand took that decision and I blessed me with a summit climb on Feb 4th, accompanied by an amazing team of 24 trekkers & brilliant guides from Indiahikes.
360 degree view from the summit after a hard climb cannot to be put in words. Apparently, a clear view is rare. We were lucky to additionally witness an intense snowfall, stargazing & trek on various terrains of snow in a span of 4 days!
Also, last week was extra special, as I started for this trek on the day after my 39th birthday and such an accomplishment sets an exciting pace for my 40s!