Experience
I’m Anuragh KP — also written Anuragh K P — a Technical Lead at Cubet Techno Labs in Kochi. I’ve been building backend systems since 2017, which makes it 9 years now, mostly in PHP and Node, increasingly in Rust.
The work splits roughly three ways: architecture and delivery at Cubet, application security both there and as a volunteer with the Kerala Police Cyberdome, and open source in whatever time is left. The security side is the thread that runs through all of it.
Volunteer. Darknet monitoring for child-safety threats on the Graphnel Project, and an AI-driven platform for detecting fraudulent activity. Angular, Python, Node.js, Elasticsearch.
Serverless commerce backends on AWS — Lambda, DynamoDB, SQS, SES, Elasticsearch. Migrated a Learning Management System from Slim 3 to Slim 4 and PHP 8.2.
RecursiveUrlLoader's preventOutside option used String.startsWith() to decide whether a discovered link was same-site, so a page under https://example.com.attacker.com passed a check written against https://example.com. There was also no filtering of private or reserved IP ranges, so a crawled page could redirect the loader at cloud metadata endpoints such as 169.254.169.254, at localhost, or at RFC 1918 addresses — potentially exposing IAM credentials. The fix replaced the prefix comparison with a strict new URL(x).origin comparison and added an SSRF validation module applied before every outbound fetch.
forceIndex() and inRandomOrder() passed their argument into the compiled SQL without validation, across the MySQL, SQLite and SQL Server grammars.