New Delhi, Aug. 30 -- The Indian Computer Emergency Response Team (Cert-In), the government's cybersecurity nodal agency, has asked a 19-year-old security researcher to hold off on publicising vulnerabilities while they are being fixed - a request the researcher rejected in a sharply worded reply accusing the agency of incompetence. Nisarga Adhikary, who made headlines earlier this year for breaking into CBSE's online marking portal, told HT he has flagged over 200 vulnerabilities to Cert-In since February 2026, mostly involving private companies, but less than 1% have been fixed. "Cert-In needs to understand that this is something I am doing out of good faith and they are actively trying to discourage me," he said. Adhikary said he has also written to the ministry of home affairs and the MeitY, which oversees Cert-In, alleging that the agency is trying to intimidate him and take credit for the vulnerabilities he has exposed. Cert-In's email, sent on the night of August 28, described Adhikary's posts as "premature" and asked him to dial back public commentary on unresolved vulnerabilities and loop the agency in on any disclosure timeline, according to a screenshot seen by HT. It cited the agency's Responsible Vulnerability Disclosure and Coordination Policy, which gives affected companies time to fix flaws before disclosure. "Public disclosure is an issue as it can enable bad actors to exploit such instances," a senior MeitY official told HT. If the vulnerability is not fully patched by the agency responsible, it can be raised again." Adhikary has been active on X in the run-up to the email. On August 28, he posted that he had "100+ critical security reports" queued up for Cert-In. Two days earlier, he had written that critical vulnerabilities he flagged in police and law-enforcement infrastructure a month before remained unpatched, even as the agency kept sending him "patched, please retest" notes that failed each retest. In his reply, Adhikary invoked the CBSE episode, arguing those flaws would not have been fixed had he not gone public. He said he gives organisations three to four weeks before saying anything publicly, and never posts proof-of-concept code, reproduction steps, endpoints or credentials. Cert-In did not immediately respond to Adhikary's claims. htc...