New Delhi, Aug. 30 -- The Indian Computer Emergency Response Team (Cert-In), the government's cybersecurity nodal agency, has asked a 19-year-old security researcher to hold off on publicising vulnerabilities while they are being fixed - a request the researcher rejected in a sharply worded reply accusing the agency of incompetence.

Nisarga Adhikary, who made headlines earlier this year for breaking into CBSE's online marking portal, told HT he has flagged over 200 vulnerabilities to Cert-In since February 2026, mostly involving private companies, but less than 1% have been fixed. "Cert-In needs to understand that this is something I am doing out of good faith and they are actively trying to discourage me," he said. Adhikary said he has ...