Sai Praneeth
I build security tooling and write about the attacks it defends against. Maintainer of RedBlueSkills — 128 agent-native security skills where every offensive technique ships paired with its detection. 151 hands-on labs deep, 298 notebook chapters written, and every claim on this page links to the proof.
Building and maintaining RedBlueSkills — 128 agent-native security skills where every attack ships with its detection — while studying Cyber Security at VIT Vellore. Practising daily on TryHackMe (252-day streak, top 3%) and writing the security notebook, now 298 chapters deep. Open to security internships, SOC / VAPT roles, and open-source collaboration.
RedBlueSkills
Offense you can't detect doesn't ship.
An open-source library of agent-native security skills. Every skill is an executable SKILL.md package that an AI agent — or a human — can load to actually perform security work: recon, exploitation for authorized assessments, detection engineering, hardening, threat hunting and incident response. 128 skills across seven application surfaces — web app, API, mobile, network, cloud-native, CI/CD and LLM/AI — every one of them paired red ↔ blue. Built to run inside CI, SOCs and pentest workflows, not just be read.
- —API: BOLA, BFLA, mass assignment, SSRF
- —Web-app exploitation & initial access
- —CI/CD, cloud-native and network attack paths
- —Mobile and LLM/AI: prompt injection, tool abuse
- —Detection engineering per attack technique
- —Hardening playbooks & secure configuration
- —Authentication and inventory monitoring
- —Rate-limit, SSRF and supply-chain defence
ForkLeaf
Notes that outlive the app that made them.
A full Markdown workspace whose database is a GitHub repository you already own. Wikilinks and backlinks, offline full-text search, a visual Mermaid diagram studio, PDF reading with sentence-level citations, branches and pull requests, publishing to GitHub Pages and a built-in MCP server so Claude can read and write your notes as ordinary commits. Nothing is stored on ForkLeaf's servers — there is no database to be locked out of.
Offensive Security
Recon through post-exploitation on authorized targets, practised daily against live lab machines.
OSINT & Reconnaissance
Building a target picture from public sources before a single packet is sent — people, infrastructure, and the sock puppets and OPSEC that keep the collection quiet.
Defensive Security
The other half of every attack — writing the rule that catches it, and hardening the thing that let it through.
Network & Traffic Analysis
Reading a capture and turning it into an answer — protocol analysis, flow reconstruction, geolocation of hostile traffic.
AI & LLM Security
Securing the model layer — prompt injection, and the outbound leakage that turns a helpful assistant into an exfiltration channel.
Security Engineering
Shipping security as software — schema validation, static analysis and release pipelines that gate every merge.
Engineering
I build the tools I need. Production React and Python, shipped to real domains and real users.
Platform & Cloud
Where the code runs and how it's kept boring.
128 executable SKILL.md packages an AI agent — or a human — can load to do real security work: recon, authorized exploitation, detection engineering, hardening, threat hunting and incident response. Every offensive skill is paired with its detection across seven surfaces, from web and API to cloud-native, CI/CD and LLM/AI.
Traffic-analysis pipeline that turns raw Wireshark captures into geographic intelligence. Parses PCAP with dpkt, geolocates every source IP against the GeoLiteCity database, and emits both a KML layer for Google My Maps and an interactive HTML dashboard reporting packets, flows, unique IPs, countries and processing time — so suspicious traffic is visible instead of buried in a capture.
Wordlist generator for authorized password audits. Turns OSINT about a target — names, dates, companies, keywords — into ranked candidate lists or a compact base list plus a generated hashcat .rule file. Policy-aware filtering emits only passwords the target policy could accept, and hard per-stage budgets stop a naive run from exploding into terabytes. Ships as a single static Go binary with a CLI, an interactive console and a local-only browser UI.
A gateway that sits between an app and its LLM, screening every prompt on the way in and every response on the way out. Targets the OWASP LLM Top 10 risks a proxy can actually reach: prompt injection, model denial of service, and outbound PII and secret leakage. Multi-tenant policy engine with a hashed-by-default audit log.
Real-time syscall monitoring for Linux. eBPF programs on syscall tracepoints stream events to user space, where rules flag privilege escalation, credential theft, process injection and reverse shells — each alert tagged with its MITRE ATT&CK technique. libbpf + CO-RE, so it ships as one static binary that needs nothing installed on the target.
Offline-first personal finance platform for iOS, Android and web. Features OCR receipt scanning, native multi-currency, loan amortization, credit-card utilisation tracking, and peer-to-peer IOUs. Includes shared household workspaces with isolated personal ledgers, and AI-powered insights.
Writeups are on the way
Step-by-step solves of web, pwn, crypto, forensics and reversing challenges from the CTFs I play. Each one gets its own discussion thread.
Education
B.Tech CSE (Cyber Security)
Certificates
9 totalLet's build
something real.
I'm looking for security internships and entry-level SOC, VAPT or security-engineering roles — and I'm always up for talking about open-source security tooling.
Book a call
Fastest route. Pick a length and a slot below — it's wired to my live calendar, so anything you can see is genuinely free.
Jump to the calendarEmail me
Pick a reason — each one opens your mail app with the subject and a short template already filled in.
Find me elsewhere
Everything I claim on this site is checkable on one of these.
Grab a slot
Choose 15, 30 or 45 minutes. Google Meet, no agenda required. Times shown in your own timezone.