Dilkhush
Choudhary
I build interfaces that behave — websites, iOS and Android apps — then I try to break them before anyone else can.
drag these ↴
- 07
- yrs
- 41
- ships
- 00
- breaches
Aurora Studio — site & CMS
Design that
moves markets
these are real, clickable components — tap the bars, rows and boards. no screenshots anywhere on this page.
toys opened 0/5
crack lab
type a password, watch it die- charset
- 36
- entropy
- 36 bits
- length
- 7
offline gpu attack · 100b guesses / sec
instantly
toy lock — cracked before your coffee cools
the lesson: length beats symbols. every extra character multiplies the search space — swapping a for @ only adds a rounding error.
A JWT arrives with alg: "none". Your library accepts it. What class of bug is this?
One question a day. Everyone in the world gets the same one. Miss a day and the streak dies.
answer locks in — choose carefully
watch the idea move
ALGORITHM
THEATRE
Six classics, stepped frame by frame. Scrub the timeline, change the data, race the speed — then read what the shape is actually telling you.
unsorted input
what this actually teaches
Every pass drags the largest value to the end. Beautiful to watch, useless at scale — n² comparisons means 1,000 items cost a million steps.
daily build · 2026-08-19
REBUILD
“THE PILL”
match
62.6%
One shape a day, generated from today’s date — everyone gets the same one. Match it using only the sliders, no peeking at the numbers. Then lock in your score.
target
your build
verdict
right family, wrong shape
Radius larger than half the height clamps to a perfect capsule. No magic numbers needed.
your wall of builds
nothing locked in yet
Pretty is
worthless if
it breaks
three real findings from recent engagements — click a pin
comment thread
IDOR on /orders/:id
Any session could read another customer's order. Patched with row-level policy + object scoping. Re-tested clean.
what I actually do
- +
Web & API pentests
OWASP Top 10, business-logic abuse, auth bypass chains.
- +
Mobile security
MASVS reviews for iOS and Android, keystore and pinning work.
- +
Secure architecture
Threat models, least-privilege data access, key rotation.
- +
Hardening & CI gates
Dependency triage, secret scanning, calm incident response.
Let's ship
something odd
Briefs, weird ideas and “can you break this?” requests all welcome.
I need…
export brief → hello@dilkhush.dev