Shrikant Bhosale

Over the last eighteen months, I developed four independent frameworks for vulnerability analysis: VMF Engine — geometric scanning with 6 projection dimensions Error Principle — information debt quantification via D_e scoring Memory Layer — 8-factor exploitability vector across memory geometries AttackGraph — graph-theoretic exploit chain modeling For a long time, I treated them as separate … Read more

Most vulnerability scanners treat each finding as an island. Finding A has CVSS 6.5. Finding B has CVSS 4.3. They’re filed, triaged, and forgotten as separate items. This misses the most important question in exploit development: can you chain them? A CVSS 4.3 info leak followed by a CVSS 6.5 use-after-free can produce a CVSS … Read more

Every security scanner I’ve used works the same way: it parses your code, matches patterns against a rulebook, and dumps a list of findings. Then a human spends hours triaging 80% false positives to find the 20% that matter. I built the VMF Engine because I wanted a scanner that thinks the way an adversary … Read more

I audit network device configurations for Indian enterprise resellers. After reviewing 50+ Cisco IOS-XE configurations from production environments, I’ve found that 80% of them expose more than they should. Here are the 10 checks your network team probably forgot. 1. Telnet Still Enabled The finding: Line VTY still permits protocol telnet alongside protocol ssh. The … Read more

I’ve scanned codebases that passed every SAST tool — SonarQube, Semgrep, CodeQL, Coverity — and found critical vulnerabilities within the first hour of manual review. Not because the tools are bad, but because they operate in a category that misses the most dangerous class of bugs. Here’s what they miss and why. 1. Exploit Chains … Read more

Code is not a list of statements. Code is a series of assumptions — about inputs, about state, about memory layout, about the caller’s intentions. Every line that lacks error handling is a debt that compounds until a security researcher collects. I call this the Error Principle: The probability that a vulnerability will be exploited … Read more

Why Your Code Needs a Security Audit Before Launch

The Error Principle: Why Unhandled Errors Become Security Vulnerabilities