Gouri Sankar A

Independent Security Researcher | Bug Bounty Hunter
CVE-2026-4092 | CVE-2026-21994 | CVE x 4
Secured: @Microsoft @Oracle @Google @Lenovo @Toyota @NFL @nasa

[Gouri Sankar A @g0w6y]

Ranked #572 globally on the Google Bug Hunters Hall of Fame 🏆

@GoogleVRP

#BugBounty #GoogleVRP #CyberSecurity #BugHunters #InfoSec

[Gouri Sankar A @g0w6y]

Ranked #572 globally on the Google Bug Hunters Hall of Fame 🏆

@GoogleVRP

#BugBounty #GoogleVRP #CyberSecurity #BugHunters #InfoSec

[Gouri Sankar A @g0w6y]

Day 2 at #BlueHatAsia 2026 opened with @jeffmoss (DEF CON & Black Hat founder). 🇸🇬

[Gouri Sankar A @g0w6y]

Day 1 at #BlueHatAsia 2026 (MSRC) done. 🇸🇬

Highlights:
Halvar Flake's "An Age of Experimentation" keynote
"PUT-ting on the Risk" one GET→PUT swap, 5 Criticals
"Four Simple Paths to Own an Entra ID Account"
DirectX kernel LPE → Hyper-V guest-to-host RCE

Thanks MSRC.

[Gouri Sankar A @g0w6y]

@MacInTheLoop @ni5arga More than 2 years back I had reported the same :)

[Gouri Sankar A @g0w6y]

Back again with another one ! Landed a $10,000 bounty from @msftsecresponse for a Remote Code Execution vulnerability !

Listed in Special Mention

Thank You @msftsecresponse

#CyberSecurity #BugBounty #InfoSec #EthicalHacking #Microsoft #MSRC

[Gouri Sankar A @g0w6y]

Got recognized by @Oracle as a Security-In-Depth Contributor in the August 2026 release

https://t.co/hGQ4umNxdu

#Oracle #CyberSecurity #SecurityResearch #BugBounty

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[International Cyber Digest @IntCyberDigest]

‼️ After the MSRC blog post about Nightmare-Eclipse, researchers are coming forward with their own MSRC horror stories.

The response from the security community isn't going Microsoft's way. As they’re not backing Microsoft.

Gabriel Landau, a well-known Windows security researcher, says he reported a Device Guard bypass with a 90-day window. MSRC told him it met their bar and they'd fix it, then asked him to hold disclosure for extra months. He agreed on the condition they issue a CVE. They patched it silently, decided after the fact it "didn't meet the bar," and never issued the CVE. In his words: "MSRC strung me along for a few extra months to keep me quiet, then broke their word."

Another researcher, rootsecdev, says he responsibly disclosed a legacy-auth flaw that allowed password spraying while avoiding smart lockout. Five months later, MSRC replied that it "doesn't meet the bar for servicing," silently fixed it, and closed the case.

Microsoft's post was meant to defend their coordinated disclosure policy. Instead it became a thread of researchers explaining why they've stopped trusting their process.

[Gouri Sankar A @g0w6y]

Honored to receive 2 Letters of Recognition from @NASA for Critical (P1) Vulnerabilities.

Waiting for the 3rd one to complete the hat-trick

Thank you @NASA Security Team

#BugBounty #CyberSecurity #NASA #Hacker #SecurityResearch

[Gouri Sankar A @g0w6y]

Excited to be featured in Google Bug Hunters Honorable Mentions ! Thank you @Google Security Team for the recognition
Grateful to be contributing to a safer internet alongside other talented researchers.
The journey continues..
#BugBounty #CyberSecurity #GoogleVRP #Sec #InfoSec

[Gouri Sankar A @g0w6y]

Received $3,133.70 from Google Vulnerability Reward Program !

Thank you @Google Security Team for the recognition

Another milestone in securing big tech.

Proud to contribute to a safer internet.

#BugBounty #CyberSecurity #GoogleVRP #Hacker #SecurityResearch

[Gouri Sankar A @g0w6y]

@4osp3l In most program this will be marked as informative , outofscope .

Because attacker need to access victim mail to get those reset link :)

[Shadan @skshadan_]

I just gave Claude Code a rooted Android phone…

It autonomously reverse-engineered Subway Surfers, hooked the coin logic, bypassed the anti-cheat, and gave itself UNLIMITED coins in ONE session.

[Gouri Sankar A @g0w6y]

@akaclandestine Thats mee !😀

[Gouri Sankar A @g0w6y]

Discovered vuln CVE-2026-21994 assigned & credited by @Oracle !
9.8 Critical in Oracle Edge Cloud Infrastructure Designer Toolkit (v0.3.0 Desktop). Unauth remote HTTP takeover.
Credit: Gouri Sankar A
https://t.co/V7HUEZic8A
NVD: https://t.co/RrvLDTkejx

[Gouri Sankar A @g0w6y]

Turns out I'm the youngest documented Indian bug bounty hunter to earn $10K+ from @Microsoft via MSRC multiple reports, multiple Hall of Fames, all at 18. Just a curious kid who loved breaking things to secure them.

#BugBounty #MSRC #EthicalHacking #CyberSecurity #Kerala

[Gouri Sankar A @g0w6y]

@CVEnew Thanks! I discovered and reported this vulnerability.
https://t.co/luu8gLOofa

[Gouri Sankar A @g0w6y]

@cyberbivash Thanks for covering this! I'm the researcher who discovered and reported CVE-2026-4092. https://t.co/luu8gLOofa

[Gouri Sankar A @g0w6y]

Just got my first CVE! 🔐

CVE-2026-4092 — Path Traversal in @google/clasp
High severity — CVSS v4: 8.7

Arbitrary file write via malicious GAS project.
Discovered, reported & fixed. Patched in v3.2.0.

- Affected: < 3.2.0
- Patched: v3.2.0

https://t.co/kL7sPPXvYd

#CVE