P1 Security researcher · Full-stack engineer · Web3 · since 2020

ANUKUL PANDEY I’ve been building and breaking things since 2020. Some of it runs a blockchain. Some of it runs on a Raspberry Pi.

Security researcher first: GitHub paid out a bounty, Domino’s put me in their hall of fame, 17+ programmes have my reports. Then the builder: five npm packages, security tools I wrote at 20 that strangers still star, a Rust contract verifier for PolkaVM that didn’t exist until I forked Blockscout, two wallets with 8,000 users, a block explorer. Three of those years as a core engineer on a live L1; the rest were hackathons, clients and things I needed. 735 pull requests merged into other people’s repos before 2026, every one linked below.

Indore, India · remote · available now, no notice period · open to full-time remote

experience

every job is a checkpoint. scroll and the car drives the lap — from a factory floor in 2021 to the finish line, which is wherever we build next.

START 2021 · lights out
  1. 2021 · Indore TUTORIAL

    Volvo Eicher Full-Stack Developer Intern

    Replaced paper defect-tracking across 8 assembly zones with a QR-driven web app — zone forms + SMS alerts — plus a paperless records app (Flask, PyMongo).

    FlaskPyMongoQR + SMS
  2. 2022 · Indore TUTORIAL

    ACOEM Ecotech Engineering Intern

    Environmental-monitoring instrumentation on the plant floor, plus Kaizen process-improvement proposals.

    instrumentationKaizenmonitoring
  3. Jan 2023 – Jun 2026 MAIN QUEST

    Reef Chain Blockchain Backend Engineer

    Core engineer across the whole stack of a live L1. 2023: the Reefscan explorer and its indexers (syncing with a 10-second block time, ~8,600 syncs/day), the @reef-chain/util-lib + react-lib SDK, and npx create-reef-app. 2024: the Flutter mobile wallet (125 merged PRs — biometrics, EVM binding, WalletConnect) and a ground-up rebuild of the Chrome wallet extension (8,000 users). 2025: led the EVM → PolkaVM migration — a Rust resolc verifier for Blockscout, a Uniswap-V2 fork, node/validator infra on Dokploy — cut a 3–4 hr release to ~2 min, and shipped a scanner for the qix npm supply-chain attack the day it hit.

    Explorer + indexersFlutter walletChrome extensionnpm SDKPolkaVMRust
  4. Jun 2023 – Jul 2025 SIDE QUEST

    SigNoz Technical Writer (Freelance)

    Authored 50+ merged PRs across 15+ language stacks (docs + sample apps), covering OpenTelemetry app- and OS-level instrumentation.

    OpenTelemetrydocs15+ stacks
  5. Nov 2024 – May 2025 SIDE QUEST

    Darve Full-Stack (Freelance)

    Built the Flutter mobile app for a social challenges & payments platform — passkey auth, chat, challenges, notifications, in-app Stripe payments — plus Rust backend services for auth, Stripe webhooks, and transaction APIs.

    FlutterRustStripepasskeys
  6. Apr 2025 – present SIDE QUEST

    Kokopai Blockchain / Full-Stack (Freelance)

    Built the multi-chain wallet & payments layer for a creator-first AI video + NFT platform: WalletConnect + MetaMask SIWE auth, Reown multi-chain support, chain-aware routing, a canonical blockchain server, and a hot-reload Docker dev stack (Colima, Infisical).

    WalletConnectSIWEReownmulti-chain
  7. Jan 2026 – Feb 2026 SIDE QUEST

    Sixth Sense AI Frontend / Product (Contract)

    Built a cross-platform desktop app with Tauri (Rust) + React + TS for an AI venue product: an AI chat assistant, structured menu CRUD, guest-feedback UX, and crash/performance triage.

    TauriRustReact
  8. next lap OPEN

    your team?

    what i’m looking for: full-stack roles at web3 startups — remote, available immediately, no notice period. contract builds and security reviews welcome too.

proof of work

commit history doesn’t lie. this is pulled live from github — every number links back to the receipts. and the timeline matters: first commit 9 july 2020, and 735 of these merges landed before february 2026, into wallets, an explorer, docs sites and client apps.

MERGED PRS BY YEAR · into other people’s repos
  1. 2023219
  2. 2024380
  3. 2025123
  4. 202683
ALL CONTRIBUTIONS BY YEAR · commits, PRs, private work
  1. 202037
  2. 2021121
  3. 2022213
  4. 20232,474
  5. 20241,531
  6. 20251,062
  7. 20261,478

counted from github on 31 oct 2026 · click a PR year to re-run the search yourself

github.com/anukulpandey ↗ snapshot · live data loads when available

projects & ventures

37 entries from 202 repos, 2020 → now. four case studies up top, then four shelves: things shipped for others, hackathons & experiments, infra i run, and writing. every card has its start year and a link to the receipt; private repos say so.

#001★ LEGENDARY2025 · RUST · IN PRODUCTION

resolc contract verifier

Blockscout could not verify a single contract on a PolkaVM chain, because its verifier only speaks solc. I taught it resolc.

I couldn’t find anyone who had done it. No fork, no docs — just Parity’s compiler, Blockscout’s Rust service, and bytecode that refused to match.

Rust
fork of blockscout-rs smart-contract-verifier
RISC-V
PolkaVM bytecode via Parity’s revive / resolc
3 days
from “cargo won’t even build” to verified contracts
  • Swapped the compiler path to always drive the resolc CLI (solc_compiler_cli.rs), threading the real solc through as resolc’s own dependency.
  • Rewrote verification matching for PolkaVM output — resolc doesn’t follow solc’s optimize-runs conventions, so the stock match rules rejected bytecode that was in fact correct.
  • Built LLVM 18 with the RISC-V embedded target to get revive compiling, and wrote the whole thing up as a repro gist so the next person doesn’t lose the days I did.
  • Runs behind the Blockscout compose for the Reef Pelagia testnet.
WEB3INFRARUST
#002★ LEGENDARYSINCE 2021 · OPEN SOURCE

Things I published

Five npm packages under my own name and a shelf of security tools strangers still star. Written when I needed them, published so others didn’t have to.

5
npm packages, 2023 → today
85 ★
on the 2021 security tools alone
0
runtime dependencies in the newest one
  • npm: create-kava-dapp (Jan 2023), create-reef-app (2023), reef-x-ws (2024), sqwid-sdk (2025), zcash-faucet (2026).
  • 2021 security tools: a WebRTC deanonymisation PoC (49★), sqlinjector (13★), LFI-Hunter, pybuster, a Termux pentest setup (9★), a subdomain-takeover kit.
  • Same-day response: qix-vuln-scanner, shipped on 8 Sep 2025, the day the chalk/debug npm supply-chain attack landed.
  • Odd ones: flutter-minimal-js (run TypeScript inside Flutter), a Tron PDF mini-statement generator, a Notion-to-HTML API.
TOOLSECURITY
#003★ LEGENDARY2023 · IN PRODUCTION

Two wallets people keep keys in

A Flutter mobile wallet and a Chrome extension for a live L1. Signing, biometrics, EVM binding, WalletConnect — the code that cannot be wrong.

8,000 users on the extension (4.5★), rebuilt from scratch on Manifest V3 in 2024.

125
merged PRs to the mobile app
61
merged PRs across two extensions
8,000
people running the extension
  • Mobile: biometric + password auth, the EVM address-binding flow, transfer validation, signature rendering, token-icon resolution, i18n. A Flutter shell driving a JS bridge to the chain libs.
  • Extension: redesign, an observable reefState store, NFT list, dark mode, localisation, decoded extrinsics, “always open in window” signing.
WEB3MOBILE
#004★ LEGENDARY2023 · FOUNDER

Droppie

Upload a CSV, get a gas-efficient Merkle-proof airdrop on any EVM chain, deployed from your own wallet. My own product, with its own org, docs and branding.

Nov 2023
first commit as “merkle-drop”
140+
commits across app, server, contracts, docs
1 tx
to claim, however many addresses
  • Started as a written blueprint, then four repos in three weeks: React app (108 commits), Node server, Solidity contracts, Docusaurus docs.
  • Rebuilt in 2026 as a Turborepo with Foundry contracts and a TypeScript SDK, under droppie-io.
WEB3TOOL

the rest of the dex

seen 0/37

shipped for other people

production code with someone else’s name on the door. the start year is on every card.

  1. #0052023 · IN PRODUCTION

    Reefscan explorer

    Block explorer, indexers and data APIs for a 10-second-block L1. 109 merged PRs: EVM-address search, decoded call data, SolidityScan, CoinGecko-compatible supply APIs, four exchange integrations.

    WEB3INFRA
    reefscan.com ↗
  2. #0062023 · ON NPM

    Reef SDK

    @reef-chain/util-lib and react-lib, the packages every Reef dApp imports (76 merged PRs: vitest port, nx monorepo, Apollo removed), then @reef-chain/evm-util-lib, written from scratch for the PolkaVM era.

    WEB3SDK
    the PRs ↗
  3. #0072023 · IN PRODUCTION

    Sqwid NFT marketplace

    NFT marketplace with per-item royalties. 46 merged PRs across backend and client: dockerised it, swapped Pusher for Firebase, moderation tooling, royalty splits. Later wrote its public SDK.

    WEB3
    sqwid.app ↗
  4. #0082024 · CLIENT · MRDAPPS

    Randomly

    An on-chain lottery dApp for MrDapps: ticket sales, draws, bulk claiming, WalletConnect, a price feed. 98 of my commits in the frontend plus the Solidity contracts repo.

    WEB3CLIENT
    private repos · monkey-god-hanuman
  5. #0092022 · GRANT

    Reef Name Service

    ENS-style names for Reef addresses. First version in December 2022 (React + Hardhat), rebuilt in 2024 with a registry, ERC-721 registrar, commit/reveal controller and resolver — Reef Community Developer Fund grant.

    WEB3
    github ↗
  6. #0102023 · API

    Reefaq staking analytics

    A Flask + MongoDB API that crunches validator and nominator data for a staking platform: APY per validator, era points, bonded totals, historical APY series for charts (45 commits), plus the staking dApp on top.

    WEB3API
    private · python
  7. #0112024 · CLIENT

    Darve

    Flutter app for a social-challenges & payments startup — passkey auth, chat, challenges, notifications, in-app Stripe — plus Rust services for auth and webhooks. 40 merged PRs.

    CLIENTMOBILE
    darve.app ↗
  8. #0122025 · CLIENT

    Kokopai

    Creator-first onchain video platform. I own the wallet & payments layer: WalletConnect + MetaMask SIWE, Reown multi-chain (Ethereum, Polygon, Arbitrum), chain-aware routing, Docker dev stack.

    WEB3CLIENT
    kokopai ↗
  9. #0132026 · CONTRACT

    Sixth Sense AI

    Cross-platform desktop app in Tauri (Rust) + React for an AI venue product: chat assistant, structured menu CRUD, guest-feedback UX, crash and performance triage. 12 merged PRs.

    AICLIENT
    private · sixth-sense-ai
  10. #0142023 · STARTUP

    Alignsy

    Backend and landing page for a mental-models startup, mid-2023: a Python service calling LLM APIs over a curated database of frameworks. Early LLM product work, before it was a résumé keyword.

    AICLIENT
    private · alignsy
  11. #0152021 · INTERNSHIP

    Volvo Eicher factory apps

    Two Flask + MongoDB apps for a truck plant: a QR-driven defect tracker replacing paper across 8 assembly zones (zone forms, SMS alerts) and a chassis registration system. Deployed on the floor.

    CLIENTPYTHON
    private · flask
  12. #0162026 · CLIENT

    Deepti Ecostays

    Booking site for a private eco-farmhouse in Madhya Pradesh — gallery, tariff and one-tap call / WhatsApp. Taking real bookings.

    CLIENT
    deeptiecostays.in ↗

hackathons & experiments

weekend builds, some of which won. the earliest are from 2021, written on a college laptop.

  1. #0172026 · 🏆 AVALANCHE WIN

    GateKeep

    Stripe for AI-agent API calls: wrap any REST endpoint in an x402 USDC paywall with ERC-8004 identity gating. Won the Avalanche hackathon; I pitched it on stage (see cutscenes).

    WEB3AI
    gatekeep.notcool.in ↗
  2. #0182023 · 🏆 GELATO WIN

    Gelato Gasless Warriors

    A pixel NFT battler where players never see a gas fee or a seed phrase: Gelato’s gasless relay + Web3Auth social login, minting to OpenSea. 37 commits, and the hackathon win.

    WEB3GAME
    github ↗
  3. #0192022 · 4 DAPPS IN A WEEK

    Reef Bengaluru hackathon

    Four submissions in one week of November 2022: a crowdfunding dApp, a staking-rewards dApp, a deflationary-token launchpad and a “poke stall” marketplace. Two months later I joined Reef full-time.

    WEB3
    github ↗
  4. #0202026 · PRIVACY SPEEDRUN

    VeilPay

    Confidential payroll on Avalanche eERC: salaries sealed with zk-SNARKs and ElGamal homomorphic encryption, a rotatable auditor key for compliance. Live on Fuji with one-click demo roles.

    WEB3ZK
    veilpay.notcool.in ↗
  5. #0212023 · HACKATHON

    Injective DEX

    A DEX front-end for the Injective hackathon with a team under nuke-labs: pools, liquidity helper, portfolio, per-token routes, network switching. 27 commits in six weeks.

    WEB3
    private · nuke-labs
  6. #0222023 · BLOCKCHAIN-PRIME

    Kava & Aptos entries

    January 2023, under my own Blockchain-Prime org: starter dApps for Kava, create-kava-dapp published to npm, and an Aptos submission written in Move. Same month we hosted Indore’s first Web3 hackerhouse.

    WEB3TOOL
    github ↗
  7. #0232022 · 11 ★

    MonkeyShare

    Unlimited file storage on IPFS, paid for once with a single on-chain transaction. Vue front-end, a Node IPFS pinning service, Reef smart contract. My first dApp that strangers starred.

    WEB3
    github ↗
  8. #0242021 · FIRST HACKATHON

    Decentralised file share

    July 2021, my first hackathon (Docothon): an Express + EJS file-sharing site, then a second version on IPFS with no storage cap that could also host static sites. The idea MonkeyShare grew out of.

    TOOL
    github ↗
  9. #0252023 · FLUTTER

    Secur-Yeti

    A password manager in Flutter, built to understand what one has to get right before trusting anyone else’s. 17 commits, March 2023.

    SECURITYMOBILE
    private · flutter
  10. #0262021 · NOTEBOOK

    Ethereum price model

    May 2021: a Jupyter notebook predicting ETH prices with a linear model, next to a diabetes-analysis notebook and a cosine-similarity movie recommender. The ML phase before the blockchain phase.

    ML
    github ↗
  11. #0272026 · LIVE

    Tryo

    Paste a makeup product link and see the shade on your face in real time — 468-point face mesh, fully on-device.

    AIAR
    tryo.notcool.in ↗
  12. #0282026 · MACOS

    Owlnighter

    Close the lid — the owl stays up. A ~0.5 MB pixel owl for the macOS menu bar that keeps builds and downloads running. No Electron.

    TOOLMACOS
    owlnighter.notcool.in ↗
  13. #0292025 · PWA

    Still on my mind, huh?

    A one-tap PWA that tells your partner you thought of them, with far too many charts (bars, radars, a gauge) to prove it. 22 commits of pure sincerity.

    TOOL
    github ↗

infra I run

servers at home, nodes in the cloud, and the dockerfiles that make them reproducible.

  1. #0302025 · MERGED UPSTREAM

    Reef node cluster kit

    Everything to stand up a Substrate testnet from nothing: dockerised bootnode, validator compose files, registration scripts, a custom chain spec, local-cluster guide — and a 1,663-line template merged into Dokploy, so anyone can one-click a Reef node.

    INFRAWEB3
    dokploy PR ↗
  2. #0312025 · TESTNET

    Testnet plumbing

    A GitHub-OAuth-gated EVM faucet, an EVM sidecar that tails blocks and pushes touched addresses over Pusher, a Blockscout compose, a hardhat-polkadot example. The unglamorous half of a chain upgrade.

    INFRAWEB3
    github ↗
  3. #0322024 · HOME SERVER

    Nebula Bifrost

    A 2008 Pentium dual-core with 3 GB of RAM turned into an always-on home server: 1.8 TB of storage, WiFi adapter drivers, services, remote access. A 37-commit setup guide so it can be rebuilt from scratch.

    INFRA
    private · the potato
  4. #0332024 · RASPBERRY PI

    nullvoid

    The potato’s successor: a Raspberry Pi 4B home server, plus an IPFS Kubo compose for pinning files and a boot-to-shell Dockerfile for remote boxes.

    INFRA
    github ↗
  5. #0342023 · BOT

    Discord faucet bot

    A Node.js Discord bot that doubles as a testnet faucet and a role manager, so devs could get test tokens without pinging a human. 21 commits.

    INFRAWEB3
    private · node

writing & community

explaining it in public is how i check i understood it.

  1. #0352023 · 50+ MERGED PRS

    SigNoz / OpenTelemetry docs

    Instrumentation guides and sample apps across 15+ stacks — PHP, Rust, .NET, Java, Go, Elixir, Swift, Kotlin, React Native, Next.js, Nginx — each one a working app I built, ran and traced before writing it up.

    DOCSOTEL
    the PRs ↗
  2. #0362023 · BLOG

    Anukul’s Tech Writeups

    Long-form write-ups when a short post won’t do: bringing a dead PSP back to life, an Android-hacking crash course, standing up a home cluster, tracing Rust with OpenTelemetry.

    WRITING
    tech-odyssey.netlify.app ↗
  3. #0372023 · CO-ORGANISER

    Indore Web3 HackerVilla

    January 2023: the first retro hackerhouse-style Web3 event for Indore’s student community, co-organised with Blockchain-Prime. Later came talks at four colleges and a GDG workshop (see cutscenes).

    WEB3EVENT
    private · event repo

security research

responsible disclosure only. some findings are public, most stay under wraps — here are the bosses on the record.

BOSS 01broken access control

GitHub

HP0/999

Surfaced an access-control gap in organisation internal repositories — an external, non-member collaborator could hold hidden push access that didn’t surface in the members list. Reported via HackerOne, triaged & fixed. GitHub Thanks · reputation 22.

LOOT · $500 bounty · resolved

Domino’s responsible-disclosure acknowledgments — Anukul Pandey listed and highlighted
BOSS 02XSS

Domino’s

HP0/999

Cross-site scripting on a public surface — reported and acknowledged in Domino’s official responsible-disclosure hall of fame (that’s my name, highlighted).

LOOT · hall of fame

see the acknowledgment ↗
BOSS 03web app

Khalsa College

HP0/999

A web-app vulnerability responsibly reported & documented to the institution — patched after disclosure.

LOOT · patched after disclosure

HackerOne profile — Anukul Pandey (0xanukul)
SAVE FILE · hackerone.com/0xanukul

A resolved GitHub bug bounty ($500), GitHub Thanks & reputation, hunting since 2022. Screenshot straight from the public profile — click through to verify.

moveset

  • SQL INJECTION↓ ↘ → + P' OR 1=1 --
  • LFI← ↙ ↓ + K../../etc/passwd
  • XSS→ ↓ ↘ + P<svg onload=…>
  • BROKEN AUTH↓ ↓ + KAuthorization: ?
  • ACCESS CONTROL→ → + P/api/org/other/…
  • LOGIC FLAWS↑ ↑ ↓ ↓ …think like the dev didn’t

OWASP Top 10 the manual way, with Burp Suite plus my own tooling: sqlinjector, LFI-Hunter, a dir-buster, a WebRTC deanonymization PoC and a qix npm supply-chain scanner.

I break it down in public on Coding Jungle, keep open teardown notes in nice-catch, and file everything responsibly — reports first, writeups later.

bosses encountered · 17+ programs

  • GitHub
  • Domino’s
  • Walt Disney
  • Automattic / Tumblr
  • Linux Foundation
  • Polygon
  • LinkedIn
  • Vercel
  • Chia Network
  • Lightspark
  • Databricks
  • New Relic
  • eToro
  • Basecamp
  • Kraken
  • Panther Labs
  • Judge.me

hardware & IoT

before protocols and pentests, i was soldering sensors and flashing microcontrollers — and taking apart anything I could get my hands on.

6 more bench builds ESP8266 robot · WiFi LED · NodeMCU notes · Arduino for beginners · Raspberry Pi server · a PSP brought back to life

mic in hand

when i’m not shipping or breaking things, i’m explaining them out loud — web3, security & building in public — to four college auditoriums and a GDG Indore crowd. below: pitching GateKeep (“agents can’t pay the way humans do”), a campus workshop, the room that showed up, and the Road to Devcon — Indore edition meetup (A36 · “Ethereum beyond the blocks”).

skills

six colours, one megazord. each ranger is a part of the toolkit — hit the button when you’re ready.

RED

backend & devops

Node.js, Flask, Docker, Nginx, CI/CD automation, Linux, Bash, Git, OpenTelemetry

BLUE

web3 / protocol

Indexers, explorers, EVM/PolkaVM, contract dev & testing, protocol forking, Substrate/Polkadot, Hardhat, wagmi/ethers, MetaMask, IPFS

YELLOW

security

Web app pentesting, vuln research & responsible disclosure, exploit tooling, OWASP Top 10 (SQLi, LFI, XSS, broken auth), Burp Suite

BLACK

languages

TypeScript, JavaScript, Python, Rust, Solidity, C++

PINK

frontend / mobile

React, Next.js, Vue, Nuxt, Flutter, Tauri

GREEN

databases

PostgreSQL, MongoDB — and the Arduino / ESP8266 bench from the garage

high scores

5npm packages published
6years shipping, since july 2020
17+bug-bounty programs reported
605+PRs merged into other people’s repos

achievements · real life

  • 🥇1st place — Reef India Hackathon10+ teams · $1,000100G
  • 🏆Winner — Gelato Hackathonhackathon win80G
  • 🔺Winner — Avalanche Hackathonbuilt GateKeep80G
  • 💰Reef Community Developer Fundgrant for Reef Name Service50G
  • 🏠Co-organised Indore Web3 HackerVillathe city’s first Web3 hackerhouse, Jan 202340G
  • 🎓B.Tech E&I, SGSITS IndoreCGPA 8.62 / 1040G
  • 🎤Web3 talks across 4 colleges+ a GDG Indore workshop40G

achievements · this site 0/10

    progress saved in your browser · no cookies · anonymous visit counts only

    no cookies. no popups.
    no newsletters. just work.

    cool is a cage. this is where i keep the receipts — wallets people hold keys in, an explorer that never stopped syncing, bugs i reported. the dates are on everything; the work predates the hype.

    hand-rolled · html · css · vanilla js · svg · no framework · no third-party trackers · just vibes

    channels

    i build in public. security & code, mostly. pick a server.

    Anukul Pandey

    hi, i’m anukul.

    Full-stack engineer (web3 · security) in Indore, India, shipping since 2020 — remote, available now, no notice period.

    Looking for full-stack roles at web3 startups. Contract builds and security reviews welcome too.