About

I'm Arvin Shivram (brutecat), a 21-year-old security researcher from 🇸🇬

Google VRP

• #7 all-time on Google VRP, #15 across all VRP programs
• 2 RCEs in Google Cloud production (Borg), $148,337 ^{[1] [2]}
• $700,000+ in bounties across 130+ vulnerabilities
• Disclosed bugs leaking PII of 4 billion+ users
• Google VRP Year in Review 2025, init.g() Mexico 2025

Open Source

• Unauthorized commits to any Forgejo/Gitea repo, with supply-chain impact to the Zig programming language
• High/critical vulnerabilities in MinIO, Rocket.Chat, ISPConfig, HestiaCP and CKAN