The Indian Computer Emergency Response Team (Cert-In) has requested a 19-year-old security researcher to refrain from disclosing vulnerabilities while they are being addressed. The researcher, however, rejected this request, responding with a strong critique of the agency’s competence. This exchange highlights ongoing tensions in India’s cybersecurity landscape.
Nisarga Adhikary, who made headlines earlier this year for breaking into CBSE’s online marking portal, told HT he has flagged over 200 vulnerabilities to Cert-In since February 2026, mostly involving private companies, but less than 1% have been fixed.
“Cert-In needs to understand that this is something I am doing out of good faith and they are actively trying to discourage me,” he said. Adhikary said he has also written to the ministry of home affairs and the ministry of electronics and information technology (MeitY), which oversees Cert-In, alleging that the agency is trying to intimidate him and take credit for the vulnerabilities he has exposed.
“The only way to get things fixed, from my experience, is to coordinate public disclosure of reported vulnerabilities. In several cases, many of the vulnerabilities I reported were only fixed after I went public with just enough details to bring light to the issue,” he said. It cited the agency’s Responsible Vulnerability Disclosure and Coordination Policy, which gives affected companies time to fix flaws before disclosure. Adhikary has been active on X in the run-up to the email. In his reply, Adhikary invoked the CBSE episode, arguing those flaws would not have been fixed had he not gone public.
Cert-In’s email, sent on the night of August 28, described Adhikary’s posts as “premature” and asked him to dial back public commentary on unresolved vulnerabilities and loop the agency in on any disclosure timeline, according to a screenshot seen by HT. On August 28, he posted that he had “100+ critical security reports” queued up for Cert-In. Two days earlier, he had written that critical vulnerabilities he flagged in police and law-enforcement infrastructure a month before remained unpatched, even as the agency kept sending him “patched, please retest” notes that failed each retest. He said he gives organisations three to four weeks before saying anything publicly, and never posts proof-of-concept code, reproduction steps, endpoints or credentials. Karan Saini, an independent security researcher from New Delhi, said Cert-In had been “slow and opaque, even when it concerns sensitive infrastructure,” citing delays on vulnerabilities affecting Aadhaar, Delhi Police’s ZIPNET, the RTI portal and the Election Commission’s website.
