KATHMANDU, NEPAL · OPEN TO OPPORTUNITIES
sushil@career:~

Backend engineer, occasional attacker.

I'm an engineering student who spends more time in backend systems than in lecture halls. Most of that time has gone into a notification pipeline that tracks notices across colleges and pushes them to students the moment they're published — matching engines, scope hierarchies, OAuth microservices, the usual. When I'm not building something, I'm usually trying to break it: bug hunting and application security are where I want to end up.

What I've been building

Notice Alert System

IN PROGRESS

A pipeline that scrapes college notice boards, matches new notices against a lattice-based scope hierarchy (institution → faculty → class → section → individual), and pushes alerts the moment something relevant is published — no more refreshing a notice board by hand. Delivery runs on Firebase Cloud Messaging, auth is handled by microservices I wrote in Go, and I've been prototyping a React Native front end so it works as a real mobile app.

GoOAuth2FCM React NativeWebhooks / ETag

go-url-shortener

LIVE

A URL shortener backend written in Go — takes a long URL, generates a short code, and redirects on lookup. Deployed and running live, built to keep the core service small, fast, and dependency-light.

Gonet/http Redirects
→ urlshortener.sushilchaulagain.com.np

Ward-Level Civic Alerts

CONCEPT

Local government notices in Nepal mostly live on ward and municipality Facebook pages, where feed ranking buries them. This flips that: residents register their ward once, and new notices get pushed straight to them over SMS or Telegram — no algorithm in the way. Designed to scale across all 753 municipalities without changing the delivery model.

Telegram Bot APISMS Gateway Scraping

Security Testing & Bug Hunting

ONGOING

Hands-on practice attacking the same kind of systems I build: OAuth flows (PKCE bypass, open redirect, CSRF, scope escalation), JWT validation edge cases, and static analysis on Go services. Working through PortSwigger Web Academy labs and live scope on HackerOne.

gosecgovulncheck Nucleisqlmapdalfox

Toolbox

BACKEND

GoReact OAuth2 / OIDCMicroservices Firebase Cloud Messaging

APPSEC

JWT validationCSRF / scope escalation gosecgovulncheck

OFFENSIVE TOOLING

Nucleisqlmapdalfox Burp Suite

Get in touch