Dev Lahrani

Third-Year Computer Engineering • VIT Pune (CGPA: 8.71)

I am a security researcher and undergraduate engineer at VIT Pune. My primary technical focus is on offensive application security, applied cryptographic protocol design, and threat intelligence.

Field Notes serves as my public vulnerability research log. Every entry documents the exact methodology, findings, technical root-causes, and defensive lessons from live security assessments.

Technical Domains & Tooling

Web Security & AppSec

Burp Suite Pro OWASP Top 10 IDOR / BOLA CORS Misconfigs Auth Bypass XSS / CSRF API Security Grails / Spring

Applied Cryptography

Shamir Secret Sharing AES-ECB / CBC / GCM Web Crypto API PKI & TLS Key Derivation PyCryptodome Reversing Crypto

Threat Intel & Forensics

MITRE ATT&CK CTI Lifecycle YARA Rules Wireshark Traffic Analysis Incident Handling

Languages & Systems

Python JavaScript / TS Go C / C++ Bash Linux Internals Git

Featured — Veli Chat

Veli Chat — E2EE, serverless, ephemeral terminal chat over Tor

v0.4.2 ↻ stars… MIT

Two-party, end-to-end encrypted, serverless terminal chat that leaves nothing on disk. Every session generates an ephemeral X3DH bundle + Tor v3 onion, exchanges a single invite code out-of-band, completes a Double Ratchet handshake, then speaks XChaCha20-Poly1305 over padded 6-bucket frames. Keys, ratchet state and history live in RAM only and are wiped on /quit.

Cryptography

X3DH Double Ratchet XChaCha20-Poly1305 Ed25519 BLAKE2b safety numbers @noble/* audited

Anonymity & Transport

Tor v3 onion services Padded buckets (256B–256KiB) Cover traffic --cover SOCKS5 Ephemeral identities No accounts

Package & CLI

npm: veilchat 0.4.2 npm: veilchat-protocol 0.2.0 bin: veil / veilchat Node 22+ pnpm 9 TypeScript 5.6 pnpm workspaces

Deep dive → View source — GitHub ↗ npmjs.com/package/veilchat ↗ npmjs.com/package/veilchat-protocol ↗ npx veilchat — or — npm i -g veilchat && veil

Invite flow: gen X3DH bundle + onion → share one invite code OOB → dial .onion via Tor → X3DH → Double Ratchet → chat → /quit wipes all state. Verify with /whois safety numbers (4×4 grid) aloud.

Resume & Contact

Seeking Security Internships for 2026 in Application Security, Penetration Testing, or Cryptography.

Download Resume (PDF) ↗ Interactive Resume Site ↗ devlahrani10@gmail.com GitHub Profile ↗ LinkedIn Profile ↗