# Adithya Poojary 19-year-old founder building secure AI products, solo. ## Identify Adithya Poojary is a 19-year-old founder building secure AI products, solo. Adithya founded ThreatScope, the company behind the product Offscan. Offscan finds security bugs in your code using AI that runs on your own machine, so your code never leaves it. ## In numbers - 5,000+ students use the platform I built at BLC - 4,600+ automated tests in Offscan - 5,000+ commits in 2026 across three products - Top 6% worldwide on TryHackMe ## Now - I am building Offscan and taking it to developers. - I lead platform and security engineering at BLC, a placement-training company in Bangalore. - And I am a 3rd-year engineering student, specialising in AI and ML. ## Work - **[Offscan](https://adithyapoojary.pages.dev/work/offscan/)** (Product, Founder · ThreatScope): Finds security bugs in your code using AI that runs on your own machine, so your code never leaves it. - **[Caliber](https://adithyapoojary.pages.dev/work/caliber/)** (Platform, Lead Platform and Security Engineer · BLC): BLC's coding and assessment platform for engineering students, which I designed and built as its lead engineer. - **[Cubicle](https://adithyapoojary.pages.dev/work/cubicle/)** (Prototype, Builder): A local-first app where a founder runs a team of AI agents, organised into rooms. - **[bbctl](https://adithyapoojary.pages.dev/work/bbctl/)** (Security, Security tooling): A human-in-the-loop bug bounty pipeline from recon to report, for authorized programs, backed by 619 tests. - **[hackypi](https://adithyapoojary.pages.dev/work/hackypi/)** (Security, Security tooling): A USB test device for authorized penetration tests that ships disarmed and fails closed. - **[Deauth Reaper](https://adithyapoojary.pages.dev/work/deauthreaper/)** (Security, Security tooling): A character-driven pwnagotchi I rebuilt from the ground up, for authorized Wi-Fi security practice. - **[Meridian Capital](https://adithyapoojary.pages.dev/work/meridian/)** (Experiment, Builder): A paper-trading bot run by six AI agents, with a Next.js dashboard. - **[CuraLife](https://adithyapoojary.pages.dev/work/curalife/)** (Client, Client demo): An outpatient platform demo for clinics in smaller Indian cities. - **[iSkew Learning](https://adithyapoojary.pages.dev/work/iskew/)** (Client, Client demo): A website redesign for a campus-training company. - **[Jarvis](https://adithyapoojary.pages.dev/work/jarvis/)** (Experiment, Builder): My fork of a hand-tracked glass board: it knows its owner, drives the real cursor, and shows your live windows. - **[ScribbleFlow](https://adithyapoojary.pages.dev/work/scribbleflow/)** (Experiment, Solo build): A terminal tool that turns one topic into a researched blog post, on a local model. ### Offscan Role: Founder · ThreatScope. When: March 2026 to now. Status: Private release, v0.2.1. Offscan is a source-code security scanner that never sends your code anywhere. Everything, including the AI, runs on your own machine. 1. **Read the code**: Its own static analysis and taint tracking follow untrusted input through the codebase. 2. **Check each finding**: An on-device model gives a second opinion on every serious finding and explains why. It never hides one or changes its severity. 3. **Connect the dots**: Related findings are joined into attack chains, so you see how small bugs combine into a real risk. Ships as: One binary per OS, Command line, Local dashboard, Pre-commit hook, GitHub Action with SARIF, Coding-agent setup. - 4,600+ automated tests - 1,180 commits since July 2026 - 0 lines of your code sent anywhere ### Caliber Role: Lead Platform and Security Engineer · BLC. When: 7 months. Status: In use, 5,000+ students. Caliber is the coding and assessment platform of BLC (Behave Like Compiler), a placement-training company for engineering students in Bangalore. BLC is not my company: I lead its platform and security engineering. As BLC's lead engineer, I led the design and build of Caliber. BLC sells it to colleges, and 5,000+ students use it. I also built blcompiler.com. - **Code in the browser**: Students write code in an in-browser editor, and test results stream back live. - **Judged in a sandbox**: Each submission is queued and run on a self-hosted Judge0, inside an isolated sandbox. - **Tests by batch**: Timed tests mix multiple-choice and coding questions, grade themselves, and are assigned by college, branch and year. - **Proctoring that records**: Webcam, fullscreen exits, devtools and duplicate sessions are recorded for review after the exam. It never ends a test on its own. - 5,000+ students - 1,985 commits, May to October 2026 - 4 interns led on an internal CRM - 3 months for that CRM project ### Cubicle Role: Builder. When: September to October 2026. Status: Prototype. A local-first desktop app where a founder runs a small AI workforce. Each person sits in their own room, and a wire between two cards is access, so a person reads only what is wired to them. The founder stays the operator. People draft, propose and speed the work up, and every action that needs a yes waits in one list. Nothing runs unless you have the app running. - **Wire for access**: Cards sit on a canvas. Draw a wire between two of them and that is access: a person reads only what is wired to them, nothing more. - **People propose, you decide**: Each person works in their own room with tools, then drafts and suggests. Anything that needs a yes lands in one Needs you list, with a standing yes you can take back. - **Runs on your machine**: Files, recordings and transcripts stay on the box, and the server listens on this machine only. Prompts go to free hosted models, with the option to keep them on a local one. Every number on a card is worked out in TypeScript, not by a model. - ~1,900 commits, Sep to Oct 2026 - 3,500+ tests - 17 ready-made teams ### bbctl Role: Security tooling. bbctl is a command line tool I built to run my authorized bug bounty work from end to end. It organizes recon, keeps track of what has been checked, and turns findings into a clean report. It is a personal tool for my own Bugcrowd engagements. Everything runs through one scope-checked gateway, and nothing is ever submitted without me. 1. **Recon inside scope**: Subdomain search starts only from in-scope wildcards; exact hosts are checked directly and never expanded. 2. **One gateway**: Every tool call passes one gateway that checks scope, the allowlist, the kill switch and the rate limit. 3. **Triage**: Findings are rated on Bugcrowd's public severity scale, and a noise gate marks scanner junk without deleting it. 4. **Draft, never submit**: Only findings I have verified become drafts with proof and repro steps. Drafts are saved, never sent; I press submit. - 619 automated tests - 277 commits - 33 commands ### hackypi Role: Security tooling. hackypi is a small USB device I turned into a governed test platform for authorized penetration tests. It presents to the host as a keyboard, and does nothing unless it is armed for one booked engagement, scoped to one target, with the operator approving each step. It ships disarmed: by default it only shows status on its screen and sends no keystrokes at all. A mistake in its settings drops it straight back to disarmed. 1. **Set up per engagement**: Target OS, keyboard layout, engagement ID and policies go in a settings file, because a USB keyboard cannot detect the host on its own. Every value is checked at boot. 2. **Fail closed**: Any error in that file forces it to disarmed, where it only shows status and sends nothing. 3. **Look before touching**: Once armed it counts down three seconds on screen, identifies the host and runs read-only checks. 4. **Ask first**: Each scoped step waits for the operator's approval. A no, or no answer in time, drops it back to disarmed. 5. **Clean up and seal**: It releases every key, then seals the audit log on the microSD card with SHA-256 hashes. - 1,035 automated tests - 24 states, only legal moves - 12 threats in its threat model ### Deauth Reaper Role: Security tooling. Deauth Reaper is my own take on the pwnagotchi: a palm-size Raspberry Pi that roams for Wi-Fi handshakes and reads its day back on a 2.13-inch e-ink face. I gave it an original character, a screen I drew from scratch, and a cloud cracking loop, then rebuilt the whole thing from a plugin into a standalone service of its own. The face is a forever-24 goth reaper with 25 moods and a running commentary. Behind it is the real work: a capture engine tuned for a single slow core, and a mobile loop that keeps hunting while it borrows internet from my phone. - **Hunts on its own**: It watches the air, picks a target by signal, and captures the handshake the way a pwnagotchi does. Weak or invalid captures are thrown away on the spot, so the loot it keeps is loot it can use. - **Cracks in the cloud**: Every capture is checked on the device and invalid ones are dropped. Good ones go to the wpa-sec community service when a tether is up; cracked keys sync back, and the reaper celebrates each one on screen. - **Tethered to a phone**: It pulls internet from my phone over Bluetooth while it roams, pushes a notification when it lands a crack, and serves its own phone-first web dashboard. No coming home to a cable. - 176 automated tests - 25 e-ink moods - 1 person building it ### Meridian Capital Role: Builder. A public experiment: an autonomous trading system where six AI agents research a stock, debate it, and place the trade. It runs on free LLMs, either Groq's free tier or a local Ollama model, so it costs nothing to run. Everything happens in Alpaca paper trading. No real money moves. It defaults to paper and only trades live if you deliberately switch it to live mode and give it a live key. I built it to learn how multi-agent systems reason and disagree, and the whole thing is open on GitHub. - **Six agents, one pipeline**: One agent researches news and fundamentals, one runs the technicals, one reads the macro cycle, one manages risk, one makes the final call, and one places the order. Each stock flows through all six every cycle. - **They can veto each other**: If the researcher's conviction is too low the pipeline short-circuits and skips the stock to save API calls. The risk manager can hard-veto a trade, and the portfolio manager cannot override it. - **It learns from closed trades**: When a position sells, the actual profit or loss is written back as a plain-English lesson into a SQLite memory table. Next time the agents look at that stock, their prompt includes the last few lessons. - **Watch it live**: A Next.js dashboard streams every decision over Server-Sent Events: the agent debate, the portfolio, benchmarks against the S&P 500, and a manual kill switch that halts all trading instantly. - 6 AI agents - 31 stocks on the watchlist - 68 automated tests ### CuraLife Role: Client demo. CuraLife is client work, not my own product: an outpatient platform built for small clinics in Tier-2 and Tier-3 India. One visit runs across two apps. Patients decide who can read their records. Doctors speak the consultation and seal the note, and the prescription plays back in Hindi. - **Patient-held consent**: A doctor gets two hours to read a patient's records only after the patient grants it. The patient can slide to revoke at any time, and access expires on its own when the window closes. - **Ambient voice scribe**: The doctor records the consultation in Hindi, English or a mix. Sarvam AI transcribes it and drafts a structured SOAP note with medications. The doctor edits and approves, and the scribe never finalises a note on its own. - **Sealed, hash-chained records**: Approving a note links it into an HMAC-SHA256 hash chain. Database triggers reject any later edit or delete of an approved record. - **Audio prescriptions and video visits**: Approved prescriptions play back as a spoken voice note in Hindi or English with a readable script. Online visits run peer to peer over WebRTC, and the backend bills only connected minutes. - 2 apps, one visit - 20 screens across both apps - 38 API endpoints ### iSkew Learning Role: Client demo. A website redesign I built for iSkew Learning, a campus career-skilling company in Thiruvananthapuram. This is client work, shown here as a demo. Their old site spoke to students. The redesign speaks to the people who actually book the programs: the training and placement heads who decide what runs on a campus. One job for the whole site, get a proposal request. - **Rebuilt for a new reader**: The old site was written for students. I rewrote the whole thing for training and placement heads, the administrators who decide whether iSkew runs on their campus. Every page points to one action: request a proposal. - **Plain files, one small backend**: Seven pages in plain HTML, CSS and JavaScript, with no framework and no build step. The three forms post to a short PHP script that emails the client over authenticated SMTP and quietly drops bots with a honeypot field. A deploy script pushes changes to their hosting over FTPS. - **Warm, not corporate**: A red, ember and onyx identity on warm paper, set in Inter Tight, Inter and JetBrains Mono. The client's own logo and real photos stay, with the logo redrawn as a clean SVG set and a brand guidelines page to go with it. - **Motion that respects the reader**: Scroll reveals and a count-up on the stats, both of which switch off on their own when a visitor asks for reduced motion. - 7 pages - 3 forms, one inbox - 24 partner colleges on the wall ### Jarvis Role: Builder. Status: Prototype. Jarvis is my fork of Bare Hands, Jared Rhodenizer's open-source glass board: a webcam watches your hands, and notes and 3D models float over the camera feed as glass cards you pinch, throw and stretch. That board, its gestures and its 3D views are his work. What I built on top turns it into a personal desk tool. It locks to its owner's face, drives the real system cursor, shows live windows from every workspace, and opens files read-only. It runs on a webcam, Chrome and standard-library Python. - **Locks to its owner**: The first face alone in frame for about three seconds is enrolled. Step away and the board frosts and locks; a stranger's hands do nothing until you approve them with a pinch or a thumbs-up. - **Click-through overlay**: The glass covers the whole display but passes every click straight through, so your hands can drive the real system pointer over whatever is underneath. - **Drive your desktop**: Point and hold to arm, and your fingertip moves and clicks the real cursor. It always starts disarmed, a fist or Esc lets go, and only the owner's hand can drive it. - **Live desks**: A Desks orb shows the windows on every workspace as glass cards, and every command it sends to the window manager goes through an allowlist. - 92 commits in three days - 64 automated tests - 10.7k lines added to the base ### ScribbleFlow Role: Solo build. When: 2026. Status: Public on GitHub. A terminal tool that takes one topic and returns a finished, SEO-shaped markdown post. You give it a topic, tone, audience and word count; it does the research, outline, drafting and SEO pass on its own. The drafting runs on a local LLM through Ollama, so there is no API key and your drafts never leave the machine. It is built as swappable parts: research, writing and prompts are separate files, and changing the model is a one-line edit. 1. **Prompt**: Enter a topic, tone, audience and word count at the terminal. 2. **Research**: It searches DuckDuckGo and scrapes the results with BeautifulSoup, no API key. 3. **Draft**: It builds an outline and drafts each section with a local LLM running on Ollama. 4. **SEO pass**: The draft gets a keyword and structure pass, with prompts kept in a separate model-agnostic layer. 5. **Export**: The finished post is written out as a clean markdown file. - 5 sources read per post - 4+ model calls per post - 376 lines of Python ## Security I have been learning security since I was 12. These are the parts I can show; private programs stay private. - **US government healthcare program** (Bugcrowd · private program, P5, Validated): An information-disclosure vulnerability in a CMS program. - **Mercedes-Benz** (Bugcrowd · private program, Invited): Invited to the private bug bounty program. - **Client penetration tests** (Authorized engagements, Delivered): Web application tests for clients. Details stay within scope. - **[TryHackMe top 6%](https://tryhackme.com/p/nullsec0001)** (nullsec0001, Ranked): Ranked in the top 6% worldwide. ### Tools built - **[Offscan](https://adithyapoojary.pages.dev/work/offscan/)** (Product): Local AI code security scanner. - **bbctl** (Bug bounty): Recon to report pipeline for authorized Bugcrowd work, with 619 tests. - **hackypi** (Hardware): A USB test device for authorized penetration tests that ships disarmed and fails closed. - **[Deauth Reaper](https://adithyapoojary.pages.dev/work/deauthreaper/)** (Hardware): A character-driven pwnagotchi I rebuilt from scratch, for authorized Wi-Fi security practice. - **[WR4TH](https://github.com/NullSecurity07/WR4TH)** (Research): Windows Defender evasion research, in a public repo. ## About I got into security at 12, out of curiosity. In March 2026, ThreatScope began as a hackathon project. By April I was building it alone, as a company. In June I rebuilt it from scratch after two earlier designs hit their limits. My first market was Indian banks: a scanner that checks their code without the code ever leaving the building. In September I turned to developers instead, because bank sales cycles were too long for a bootstrapped founder. In October the product became Offscan. ### How I work Before one release I found and fixed a critical SSH-key leak in my own code. I treat my own projects like targets. I build alone at the speed of a team by running AI agents in parallel, often overnight, and I check every claim before it ships. ### Education BE Computer Science and Engineering, AI and ML, Alva's Institute of Engineering and Technology. 2024 to 2028 · 3rd year. ### Timeline - **Security starts** (Age 12): Out of curiosity. - **Engineering** (2024): BE in Computer Science, AI and ML. - **ThreatScope starts** (March 2026): A hackathon project. - **Going solo** (April 2026): ThreatScope becomes a company, built by one person. - **Lead engineer at BLC** (April 2026): Building and securing the platform. - **Rebuilt from scratch** (June 2026): After two earlier designs hit their limits. - **Banks to developers** (September 2026): Bank sales cycles were too long for a bootstrapped founder. - **Offscan** (October 2026): The product gets its name. v0.2.0, private release. ### Stack - **Security**: OWASP Top 10, Burp Suite, Nmap, Wireshark, Metasploit, AV and AMSI evasion research. - **AI**: Local LLMs with Ollama, scikit-learn, OpenCV, MediaPipe. - **Full stack**: TypeScript, Next.js, Express, MongoDB, Redis, BullMQ, Judge0. - **Languages**: Python, JavaScript, PowerShell, Bash, C, SQL. - **Infra**: Linux, Docker, Nginx, Git. ## In short ### Who is Adithya Poojary? Adithya Poojary is a 19-year-old founder and security engineer based in India. Adithya founded ThreatScope, the company behind Offscan, a code security scanner whose AI runs on your own machine. Adithya also leads platform and security engineering at BLC in Bangalore and studies AI and ML engineering. ### What is Offscan? Offscan finds security bugs in your code using AI that runs on your own machine, so your code never leaves it. An on-device model gives a second opinion on every serious finding and explains why, and it never hides a finding. It is built by ThreatScope, Adithya Poojary's company, and backed by 4,600+ automated tests. ### What security work has Adithya Poojary done? Adithya has been learning security since age 12. That includes a validated bug bounty finding on Bugcrowd, an invitation to Mercedes-Benz's private bug bounty program, authorized web application penetration tests for clients, and a top 6% worldwide rank on TryHackMe. Adithya also built hackypi, a fail-closed USB test device, and bbctl, a bug bounty pipeline. ### What has Adithya Poojary built at BLC? At BLC, a placement-training company in Bangalore, Adithya built Caliber, a coding and assessment platform used by 5,000+ engineering students, and leads BLC's platform and security engineering. ### How can I contact Adithya Poojary? Connect on LinkedIn at linkedin.com/in/adithyapoojary, email thisisadithya07@gmail.com, or read the code on GitHub at github.com/NullSecurity07. ## Let's connect I am not looking for work. I am looking for good people to know. - [Connect on LinkedIn](https://www.linkedin.com/in/adithyapoojary/) - [thisisadithya07@gmail.com](mailto:thisisadithya07@gmail.com) - [GitHub](https://github.com/NullSecurity07)