02 / Projects
DigiLocker Security Research
Critical Infrastructure Protection
Security500M+ Users10+ VulnsGovt. Acknowledged
Problem
DigiLocker is India's national digital document wallet, used by hundreds of millions of citizens. Weaknesses in authentication, access control, or the Android client can expose personal records at national scale.
Approach
Assessed the Android client and supporting APIs with reverse engineering and application-security testing - Frida, Burp, Smali, and standard AppSec methodology - then reported findings through responsible disclosure.
Impact
10+ critical and high-severity issues, including IDORs and broken access control, affecting 500M+ users. Officially acknowledged on the DigiLocker Security Credits page by the Government of India.
Stack
Android REAppSecFridaBurpSmaliMetasploit