I Hacked Two Government Portals: How I Found the Bugs and Reported Them

How I found critical vulnerabilities in two Chhattisgarh Government portals and responsibly disclosed them to CERT-In.

Key Questions Every Engineering Team Must Ask

1. Does every control the UI enforces also exist on the server? If you deleted all your JavaScript, would the endpoint still refuse bad input?
2. Can I change an ID in the URL and see someone else's data? If the answer is “only if you guess it,” and the IDs are sequential, the answer is yes.
3. Are there test accounts, debug pages or verbose errors in prod? Grep the rendered HTML, not just the repository.
4. Is it HTTPS everywhere, with Secure cookies and HSTS? In 2026 this shouldn't be a finding, but here we are.
5. Who gets an email when someone finds a bug? Have a working security contact, ideally a security.txt. Half my CCs bounced.

The thing that stuck with me is how ordinary these bugs were. No fancy chain, no novel technique. Just missing server-side authorization checks on systems holding real people's sensitive data—the exact thing we flag in PR code reviews every week.

The odd fate of the defender is that when you succeed, nothing happens, and nothing is what you get thanked for. Thousands of students and teachers will never know their personal records were once exposed on a public URL. That's fine. That is the job working as intended.

India is building public digital infrastructure faster than almost anyone ever has, mostly with small teams on tight deadlines. Something that size cannot be guarded by its builders alone. Civilisation, as history keeps reminding us, is held together less by laws than by habits—by lots of ordinary people doing the dull right thing when nobody would know if they didn't. In our corner of the world, that habit looks like noticing a missing check, filing a clear report at 1 a.m., and having the patience to see it through.

If you've found something similar and aren't sure how to report it, feel free to reach out. Happy to share my disclosure report template.

Your Name · yourname.me · LinkedIn