How I "Hacked" an Airline Website to Get Back My Luggage
A first-person account of a Twitter thread pointing out data security flaws in an airline's website โ and how it went viral.
Read more โBuilding Bailoutt and Kitaaben.
I'm a Bangalore-based software engineer with 10+ years of experience. I consult with early-stage startups on product and engineering, build interesting stuff, and write about tech. I'm also the developer who identified a data privacy vulnerability on an airline's website using nothing but browser dev tools โ a story picked up by BBC, The Hindu, and outlets worldwide.
Have an interesting opportunity you think I'd be a good fit for? Let's connect.
I'm Nandan โ most people online know me as the techie who "hacked" an airline website to get his bag back. Off Twitter, I'm a software engineer with 10+ years of experience, and I consult with early-stage startups on product and engineering.
I currently lead architecture and security at Baggage Media, and I'm CEO/Director at Pawrivarik Technologies, where we help startups cut hiring turnaround time. Before that, I spent five years at o9 Solutions building UI infrastructure, dark mode, and NLP tooling for their planning platform.
My claim to fame was a 2022 Twitter thread about a data privacy flaw on an airline's website that went viral for the right reasons โ covered by BBC, Times of India, Boing Boing, Lallantop, and others, and picked up by radio and podcasts around the world.
Off-screen: photography, gardening, snooker, and boxing โ though my toughest sparring partner these days is a toddler boy who never taps out. I own a lot of plants and talk to them (mostly pep talks); turns out that was just practice for fatherhood.
Responsible for overall product architecture, team direction, and security posture across Baggage Media's web marketing and development stack.
Helping startups reduce hiring turnaround time with a platform for sourcing and vetting talent.
Senior developer in the R&D team, building and debugging core product features and leading the Natural Language Processing project.
Led a UI facelift across multiple fonts and colour palettes, shipped the product's dark mode, and built widgets including Pie Chart, Gauge Chart, and KPI.
Implemented and integrated TLS 1.2 (client and server side) for Redis, R-serve, Thrift, and HBase; modernised file upload, default landing workspace, and Online Meetings UI/middleware.
Developed and maintained client websites for Rogers, Nissan, and LCBO.
Built features for Rogers and LCBO.
Presented a talk on Accelerated Mobile Pages and Progressive Web Apps.
Trained in HTML, CSS, JavaScript, TypeScript, and Angular 2.
Built e-commerce solutions with Python and Django.
Completed a B.E. in Computer Science and Engineering under VTU.
In 2022, a Twitter thread about a data privacy flaw on an airline's website went viral and was picked up by outlets worldwide.
A quick link to some of my recent posts.
Latest post: How I Moved My Google AI Studio App to GitHub CI โ
A first-person account of a Twitter thread pointing out data security flaws in an airline's website โ and how it went viral.
Read more โ
Notes from learning system design, one topic at a time โ OSI, TCP/IP, load balancers, DNS, and more.
Read more โDownload a PDF copy of my resume for the complete work history.
Download Resume