The Story
A security research engagement independently conducted by Honey Jakundiya, one of our founding members, resulting in a valid vulnerability report through Google’s Vulnerability Reward Program (VRP). At the time, Honey was ranked #55 among security researchers across India.
The Challenge
The research started with a simple goal: understand how a real-world Google service behaved when pushed beyond its expected use cases. Honey Jakundiya independently explored the attack surface, looking for small inconsistencies that could potentially turn into a meaningful security issue.
Rather than relying only on automated scanners, Honey spent time manually understanding the application flow, testing different inputs, observing how requests were handled, and gradually narrowing down the behavior that looked unusual.
Once the behavior was identified, the next challenge was proving that it was actually a security vulnerability and not simply an unexpected application response. The testing had to remain controlled and non-destructive while still providing enough evidence to demonstrate the real-world impact.
The final goal was not just to find something interesting, but to build a clear and reproducible case that Google’s security team could independently verify.
The Solution
Honey approached the issue through a combination of manual reconnaissance, application analysis, request manipulation, and iterative testing. Each test was designed to answer a specific question about the application’s security boundary rather than blindly throwing payloads at the target.
After identifying the vulnerable behavior, Honey reduced the research into a reliable proof of concept that reproduced the issue consistently without affecting production users or services.
The report was then submitted through Google’s Vulnerability Reward Program with detailed reproduction steps, supporting evidence, technical reasoning, and an explanation of the potential security impact. This helped the Google security team quickly understand both the root behavior and why it mattered.
The vulnerability was reviewed and validated by Google, resulting in recognition through the VRP. The achievement also contributed to Honey’s ranking as the #55 security researcher across India at the time.