The Indian Computer Emergency Response Team (Cert-In), the government’s cybersecurity nodal agency, has asked a 19-year-old security researcher to hold off on publicising vulnerabilities while they are being fixed — a request the researcher rejected in a sharply worded reply accusing the agency of incompetence.
Nisarga Adhikary, who made headlines earlier this year for breaking into CBSE’s online marking portal, told HT he has flagged over 200 vulnerabilities to Cert-In since February 2026, mostly involving private companies, but less than 1% have been fixed. “Cert-In needs to understand that this is something I am doing out of good faith and they are actively trying to discourage me,” he said. Adhikary said he has also written to the ministry of home affairs and the ministry of electronics and information technology (MeitY), which oversees Cert-In, alleging that the agency is trying to intimidate him and take credit for the vulnerabilities he has exposed.
Cert-In’s email, sent on the night of August 28, described Adhikary’s posts as “premature” and asked him to dial back public commentary on unresolved vulnerabilities and loop the agency in on any disclosure timeline, according to a screenshot seen by HT. It cited the agency’s Responsible Vulnerability Disclosure and Coordination Policy, which gives affected companies time to fix flaws before disclosure.
“Public disclosure is an issue as it can enable bad actors to exploit such instances,” a senior MeitY official told HT. “We welcome information on vulnerabilities which are then shared with the owners of the applications, who have the fundamental responsibility to patch. If the vulnerability is not fully patched by the agency responsible, it can be raised again.”
{{/usCountry}}“Public disclosure is an issue as it can enable bad actors to exploit such instances,” a senior MeitY official told HT. “We welcome information on vulnerabilities which are then shared with the owners of the applications, who have the fundamental responsibility to patch. If the vulnerability is not fully patched by the agency responsible, it can be raised again.”
{{/usCountry}}Adhikary has been active on X in the run-up to the email. On August 28, he posted that he had “100+ critical security reports” queued up for Cert-In. Two days earlier, he had written that critical vulnerabilities he flagged in police and law-enforcement infrastructure a month before remained unpatched, even as the agency kept sending him “patched, please retest” notes that failed each retest.
In his reply, Adhikary invoked the CBSE episode, arguing those flaws would not have been fixed had he not gone public. He said he gives organisations three to four weeks before saying anything publicly, and never posts proof-of-concept code, reproduction steps, endpoints or credentials.
Cert-In did not immediately respond to Adhikary’s claims.
Karan Saini, an independent security researcher from New Delhi, said Cert-In had been “slow and opaque, even when it concerns sensitive infrastructure,” citing delays on vulnerabilities affecting Aadhaar, Delhi Police’s ZIPNET, the RTI portal and the Election Commission’s website. “The only way to get things fixed, from my experience, is to coordinate public disclosure of reported vulnerabilities. In several cases, many of the vulnerabilities I reported were only fixed after I went public with just enough details to bring light to the issue,” he said.