Yahoo Finance
NewsBytes
Perplexity
Paubox
Radom
CyberMaterial
The420.in
Tech Behind Fintech
Success Quarterly
Washington Weekly Times
Abijita
Brave iOS: Private-tab Face ID authentication bypass
2026Reported a deep-link path that bypassed the private-tab Face ID check on an unlocked iPhone. Brave fixed the issue and credited the report in its release notes.
I build security programs from scratch for startups.
I’m Lohith Gowda M, Staff Application Security Engineer at Atomicwork in Bengaluru. 7+ years across application, cloud and AI security, DevSecOps and offensive testing. I work with engineering to build security into applications, cloud infrastructure and AI workflows, and I run the compliance work that comes with it.
AI & MCP SecuritySupply Chain SecurityCloud SecurityApplication & API SecurityMobile SecurityCompliance (SOC 2, ISO 27001)
Featured in
“The issue, discovered by security researcher Lohith Gowda, affected the API that Naukri used on its Android and iOS apps.”
TechCrunch · May 2025Research & disclosures
I report vulnerabilities and contribute to security tooling. These are selected disclosures and merged contributions, with links to the public records. The rest went through private programs and stay confidential.
Researcher profiles
E2B: BTF and eBPF tracing support in sandbox kernels
2026Open sourceI contributed two merged PRs to E2B’s guest kernels, enabling BTF and eBPF tracing support on x86_64 and ARM64 for runtime-security tooling.
Naukri: Recruiter email disclosure through mobile API
2025Reported an API issue in Naukri’s mobile apps that returned recruiter email addresses. Naukri fixed it after disclosure; covered above.
Cursor: Broken access control in team billing API
2024GHSA-g4ff-54cv-h6f9Reported an authorization flaw that let non-admin team members access the team’s billing page. Cursor restricted access to admins and credited the report in its advisory.
Firefox iOS: Open redirect via QR scanner
2024CVE-2024-0953Reported that the QR scanner opened a destination without asking for confirmation. Mozilla credited the finding and fixed it in Firefox for iOS 129.
Cloudflare: Blind SSRF and password-policy bypass
2022Reported a blind SSRF caused by a Sentry configuration, and separately a password-policy bypass where the server accepted passwords the UI rejected. Both fixed and disclosed.
Google
Amazon
LinkedIn
Uber
BMW Group
1Password
Robinhood
Automattic
Flipkart
Swiggy
PhonePe
Zomato
Blinkit
Nexo
Sorare
Adafruit
Cloudways
Hostinger
Groww
Soundtrack
BigBasket
Media MarkupExperience
Seven years across five startups, usually as the first or only security hire. Each role below is where I built the program from scratch.
Staff Application Security Engineer
Jan 2026 - Present
I lead security at Atomicwork and am building the program from the ground up across application, cloud and AI. Much of my time goes into testing how our AI agents and MCP integrations can be abused, reviewing new designs before they ship, and putting security checks into the CI/CD pipeline so problems get caught early. I run the bug bounty program, and when something is found, I usually raise the fix with engineering myself.
Senior Security Engineer
Jun 2025 - Jan 2026
Acko is an insurance company, so customer data was the priority. I built an internal SBOM dashboard that shows every repository’s dependencies and vulnerabilities in one place and alerts the team on Slack when something critical or malicious appears. I also launched the public bug bounty program, tested the web and mobile apps myself, and tightened cloud security across AWS and GCP.
Senior Security Engineer
Jun 2023 - Jun 2025
Plivo runs communications APIs for other businesses, so supply-chain and cloud risk mattered most. I built the pipelines that scan every dependency and generate SBOMs, a package firewall that blocks malicious open-source packages before they install, and secret and code scanning in CI/CD. On the cloud side I moved us to AWS WAF with alerting on GuardDuty and CloudTrail events, and automated AWS Inspector triage so reviews that took days took hours.
Senior Security Engineer
May 2021 - Jun 2023
I was Airmeet’s only security engineer, so everything started from zero. I set up security testing for the APIs, mobile apps and cloud, opened a vulnerability disclosure program and handled the reports that came in, wrote custom Cloudflare WAF rules, and tested every production release. I also took Airmeet through ISO 27001 and SOC 2 end to end, from the controls to the evidence to the auditors.
Security Engineer
Jul 2019 - May 2021
My first security role. I conducted internal and external penetration testing across web, mobile, network, and API environments. I also managed OS patching and vulnerability remediation cycles, including log reviews and verification before and after patching, and collaborated with engineering and DevOps teams to resolve production issues.
