01 / INTRO
GENERATIVE AI ENGINEER. SECURITY RESEARCHER.
Hackathon Wins
Projects Built
Prize Money Won
Two halves of the same job. I build production AI agents and RAG systems, then turn around and attack them — because the fastest way to learn where a system fails is to be the one who makes it fail.
I'm Madhan, based in Andhra Pradesh, India. I'm a 2026 B.Tech CSE-AI student who spent the last two years doing one thing repeatedly: entering hackathons and shipping the whole product before the clock ran out. Six of those ended in a win — four national, two international.
The work is mostly agents. LangGraph orchestration, RAG pipelines that hold up on real documents, LLM plumbing that has to survive contact with actual users. I've built it inside an enterprise HRMS at HRTek, on Azure at Microsoft, and in a research lab at MANIT Bhopal where I got a facial authenticity model to 99.4%.
The other half is security. I research how AI systems break — prompt injection, tool-call abuse, data leaking out of RAG pipelines — plus the ordinary web flaws that still cause most real breaches. When I find something, the company hears about it privately first, with a working proof of concept and a fix. Nothing goes public until it's patched.
EDUCATION
Computer Science & Engineering — Artificial Intelligence
CURRENTLY
Every one of these was built and shipped inside the clock — usually 24 to 72 hours, always end to end. Open a row for what it actually did.
Built ZKGate, a zero-knowledge identity verification system on HashKey Chain. Enables privacy-preserving credential proofs without exposing sensitive user data on-chain.
BUILT WITH
I research the security of AI systems and web applications, then report what I find to the companies that own them — privately, with a working proof of concept and a fix recommendation, before anyone else sees it.
01
02
03
DISCLOSURE PROCESS
Testing starts only within a published bug bounty scope, a security.txt policy, or written permission from the owner. No exceptions.
Map the real attack surface — auth boundaries, trust assumptions, and where untrusted input reaches something that acts on it.
Prove impact with the least intrusive test that demonstrates it. No pivoting, no data exfiltration, no damage to production.
A written report with reproduction steps, realistic impact, severity rating, and a concrete remediation recommendation.
The vendor gets time to fix it. Nothing goes public until the fix ships and they are comfortable with the write-up.
PUBLIC DISCLOSURES
Nothing published yet — by design.
Findings land here only once the vendor has shipped a fix and is comfortable with the write-up. Reports in flight stay private. Research notes go out on @jmadhanai first.
RULES I WORK UNDER
I work with companies to find vulnerabilities in their web apps, APIs, and AI features — then hand over a clear report on how to close them. Authorized engagements only: you approve the scope in writing before anything is tested.
Enterprise AI at HRTek, deep-learning research at MANIT Bhopal, Azure AI at Microsoft — and Hyperplott, which I co-founded and still build.
FOUNDED
Deterministic DOE statistical analysis SaaS — parity with JMP/Minitab/Design-Expert, but AI-powered and built for researchers.
BUILT FOR
APPROACH
Deterministic math engine (numpy/scipy/statsmodels) + Groq LLM for interpretation
AI-powered insights at fraction of legacy software cost
AI agents, RAG systems, Web3 protocols, computer vision, full-stack products. Filter by what you care about — every row links to the code.
3-agent GitLab security pipeline published to GitLab AI Catalog. Automatically reviews Merge Requests for OWASP vulnerabilities and generates working fix code in <90 seconds.
A three-agent pipeline that reviews merge requests and writes the fix
Code review catches vulnerabilities only when a reviewer both notices the flaw and knows the remediation. Security Sentinel automates that path: it triggers on a GitLab merge request, scans the diff for OWASP-class vulnerabilities, and produces working replacement code rather than a warning a developer has to interpret.
The system is three agents in a LangGraph state machine — an OWASP Security Scanner, a Code Quality Analyst, and a Fix Suggester — chained so each stage narrows what the next has to reason about. Splitting the work this way keeps each prompt tightly scoped, which matters because a single agent asked to both find and fix a vulnerability in one pass tends to do both poorly.
Inference runs on Groq, whose throughput is what makes the sub-90-second end-to-end budget achievable inside CI, where a slow check simply gets ignored. The project won the GitLab Duo Agent Platform hackathon and is published to the GitLab AI Catalog.
ARCHITECTURE
DEPLOYMENT
RESULTS
| METRIC | VALUE | HOW IT WAS MEASURED |
|---|---|---|
| End-to-end review time | <90s | Scan through to generated fix, per project documentation |
NOT YET MEASURED
Autonomous 3-agent DeFi risk manager on NEAR Protocol. Monitors positions every 5 mins, scores liquidation risk with Groq LLaMA 3.3 70B, stores tamper-proof audit logs on Filecoin.
Autonomous DeFi liquidation-risk monitoring with tamper-proof logs
Leveraged DeFi positions get liquidated because nobody is watching at 3am. RiskSentinel runs continuously against wallet positions on NEAR Protocol, scoring liquidation risk and alerting before the threshold is crossed rather than after.
It is a three-agent LangGraph system polling positions every five minutes. Risk scoring runs on Groq LLaMA 3.3 70B, chosen because the reasoning step has to weigh several correlated signals — collateral ratio, volatility, position size — and produce a judgement rather than a threshold comparison that could be written as a simple rule.
Alerts and audit logs are written to Filecoin via Storacha. That choice is the substantive one: an alerting system that can rewrite its own history is worthless in a dispute, so the log lives somewhere the operator cannot silently alter it. The project won the NEAR Protocol DeFi hackathon.
ARCHITECTURE
DEPLOYMENT
RESULTS
| METRIC | VALUE | HOW IT WAS MEASURED |
|---|---|---|
| Polling interval | 5 min | System configuration |
| Risk-scoring model | LLaMA 3.3 70B | Served via Groq |
NOT YET MEASURED
Job intelligence agent with 3 Hindsight semantic memory streams. Learns from every rejection, updates its own reasoning errors, and discovers real patterns from your application history.
Autonomous job application engine. Navigates Lever, Greenhouse, Workday portals like a human — fills forms, uploads resume, answers screening questions, submits, and streams live progress to your browser.
Autonomous AI agent that clones any GitHub repo, runs a 5-phase audit (Plan → Execute → Delegate → Synthesize → Publish), applies 14+ auto-fixes, and opens a PR — in one coherent session with 60 tools via semantic Tool RAG.
Multi-agent AI exam prep platform with 7 specialized agents, custom TF-IDF semantic RAG pipeline, real-time streaming voice Q&A, all grounded in students' own uploaded documents.
AI culture platform that quantifies the '6 Pillars of Love' as business metrics. Coaches leaders through difficult conversations, suggests Team Rituals to fix root causes, and exports reframes to Slack or Email.
Enterprise AI telecalling platform. FastAPI backend with LangChain orchestration for multi-tenant call management.
🥈 2nd Place — HashKey Chain Horizon Hackathon. Zero-knowledge identity verification on HashKey Chain using Groth16 proofs (Circom). KYC, age proof, and accredited-investor status — zero personal data on-chain.
World's first ZK + AI credit scoring protocol on Midnight Network. Groq LLaMA scores your finances locally → ZK-SNARK proof submitted on-chain → soulbound credential badges unlock DeFi lending pools. Zero bytes of raw data transmitted.
AI-powered Multi-Chain DeFi MCP Server covering Ethereum, Polygon, and Solana. Features AI Portfolio Doctor, Strategy Sommelier, and automated yield optimization via Comput3 AI + LLaMA models.
Trustless on-chain P2P marketplace for EVE Frontier game items on Sui blockchain. Smart Move contracts handle escrow, 1% platform fee auto-split, and Smart Assembly Terminal integration for in-game trading.
Permissionless creator token index fund protocol on Solana's Bags (bags.fm). Curate baskets of creator tokens, buy indexes in one click, fork existing ones, and earn 0.5% fees on every trade forever.
India's first AI investment fraud prevention platform. Monitors 15+ social media platforms 24/7 using BERT/LSTM models, verifies SEBI advisor credentials in real-time, and maps fraud networks with interactive visualization.
Offline-first study app with hand-rolled sync engine using Lamport logical clocks. Two devices diverge offline, reconnect, and converge to identical state — provably. Rewards fire exactly once even from both devices.
🥇 MIT Mysore Hackathon Winner. AI-powered research paper generation platform. Transforms abstracts into professionally formatted papers with auto-citations in APA, MLA, IEEE, and Chicago. Export to PDF, DOCX, LaTeX.
AI-powered job matching platform. Upload your resume PDF → skills auto-extracted → personalized job recommendations with match percentage scores. Dual roles: Job Seeker and Recruiter.
AI-powered learning platform that generates personalized video lessons, summarizes texts, creates assignments, predicts student performance, and identifies individual strengths and weaknesses.
Intelligent fee management system for VEMU Institute. Final year B.Tech project with smart invoice generation, payment tracking, and automated reconciliation.
DOE (Design of Experiments) statistical analysis SaaS for pharma/biotech researchers. Deterministic numpy/scipy/statsmodels engine + Groq AI for human-readable interpretation. Parity with JMP/Minitab at a fraction of the cost.
Fully offline AI medical triage for rural India. Gemma 4 (gemma3:4b) via Ollama — zero internet, works on ₹4,000 Android. 22 features including WHO IMCI safety rails, RDT strip reader, snakebite identifier, and multilingual voice in 4 Indian languages.
MANIT Bhopal research internship project. 99.4% accuracy facial authenticity verification using custom ResNet50 deep learning architecture optimized for real-time edge deployment.
A 99.4% accurate spoof-detection model built for the edge
A research internship project at MANIT Bhopal targeting presentation-attack detection: deciding whether a face presented to a camera belongs to a live person or to a photograph, screen or mask. The constraint that shaped the whole design was real-time inference on edge hardware rather than a GPU server.
The classifier is a custom architecture built on ResNet50. Residual connections matter here because the discriminating signal in spoof detection is fine-grained texture — moiré patterns from screens, paper grain, specular highlights — which is exactly the high-frequency detail that degrades through a deep plain network but survives across residual blocks.
The model reached 99.4% accuracy on the evaluation set and was optimised for real-time edge deployment.
ARCHITECTURE
DEPLOYMENT
RESULTS
| METRIC | VALUE | HOW IT WAS MEASURED |
|---|---|---|
| Accuracy | 99.4% | Evaluation set, MANIT Bhopal research internship |
NOT YET MEASURED
AI-powered TB diagnosis and care platform. Uses CAD4TB for X-ray probability scoring, TensorFlow Lite for offline inference, and supports multilingual patient education in Kannada, Telugu, Tamil, and Malayalam.
Azure AI document summarization tool built during the Microsoft internship. Achieved a ROUGE-L score of 0.85 (+15% improvement) processing large-scale enterprise data with Azure Cognitive Services.
Summarising enterprise documents at scale on Azure
Built during a Microsoft internship, DocuMind addresses a problem most enterprises hit once their document store outgrows search: people cannot read fast enough to find what matters. The brief was automated summarisation over large-scale internal documents, accurate enough that a reader could trust the summary instead of opening the source.
The pipeline runs extraction and normalisation through Azure Cognitive Services, then passes cleaned text to GPT-3.5 for abstractive summarisation, with LangChain handling chunking and prompt orchestration so that documents longer than the context window are summarised hierarchically rather than truncated.
Quality was measured with ROUGE-L, which scores the longest common subsequence between generated and reference summaries — the standard choice for abstractive summarisation because it rewards preserved ordering rather than mere word overlap. The final configuration reached 0.85, a 15% improvement over the baseline prompt-and-truncate approach.
DATASETS
ARCHITECTURE
DEPLOYMENT
RESULTS
| METRIC | VALUE | HOW IT WAS MEASURED |
|---|---|---|
| ROUGE-L | 0.85 | Measured against reference summaries during the internship |
| Improvement over baseline | +15% | Compared against the pre-optimisation pipeline |
NOT YET MEASURED
🥇 National Hackathon Winner (5th consecutive win). Women's cyber safety platform with 24/7 Telegram monitoring, AI threat detection, and real-time emergency response coordination.
AI-powered artisan marketplace. TOI Ideas for India #1 ranked. Connects 10K+ artisans to global markets with GPT-4 product storytelling and Stripe payments.
Write-ups on AI systems, disclosure practice, and what actually happens when you ship an agent into production. Vendors stay unnamed until a fix is live.
BUILD WALKTHROUGHS · VIDEO
01
02
03
04
05
06
Tools I've actually shipped with — not a list of everything I've read about. Certifications below are all current.
CERTIFICATIONS
RECOGNITION
Selected for the Grand Finale among 12,000+ submissions from across India for Bharatcraft — an AI platform connecting Indian artisans directly to global buyers, cutting out the middlemen. Featured in the TOI Ideas for India Book as a solution for Viksit Bharat 2047.
Hiring, freelance, or a security review — email is the fastest way through. I read everything and reply within a day.
AVAILABLE FOR
LangGraph orchestration, retrieval that holds up on real documents, LLM features wired into an existing product.
Web apps, APIs, and AI features. Authorized engagements only — you approve scope in writing first.
Next.js and FastAPI products taken from empty repo to deployed and monitored.
APPENDIX / WHO IS J MADHAN
J Madhan — also known as Madhan J — is a Generative AI Engineer, Full-Stack Developer, and serial hackathon winner from Andhra Pradesh, India. With 6 hackathon victories across national and international competitions, Madhan has proven his ability to build production-ready AI systems under extreme time pressure.
As the Co-Founder of Hyperplott, Madhan leads the technical vision behind a DOE statistical analysis SaaS built for pharmaceutical and biotech researchers — a deterministic math engine paired with LLM-powered interpretation. His work spans AI agent development, LLM-powered applications, Web3 protocols, zero-knowledge proofs, and computer vision.
Madhan's technical stack includes LangChain, LangGraph, Groq, PyTorch, TensorFlow, Next.js, React, FastAPI, Solidity, and Azure AI. He has built 30+ projects including autonomous AI agents, DeFi risk monitors, ZK identity protocols, and medical AI triage systems. His research internship at MANIT Bhopal produced a facial authenticity verification system achieving 99.4% accuracy.
J Madhan is a final-year B.Tech student in Computer Science & Engineering (Artificial Intelligence) at VEMU Institute of Technology. He holds certifications from AWS, Microsoft Azure, Oracle, Google, and NVIDIA. Madhan is currently available for freelance projects, full-time roles, and consulting in AI/ML, full-stack development, and Web3 engineering.
APPENDIX / FREQUENTLY ASKED