# Arjan Chaudhary

> Arjan Chaudhary (@arjanchaudharyy) is a 16-year-old security researcher, founder, and bug bounty hunter from Nepal. He disclosed 50+ vulnerabilities to Google, MIT, Stanford, and others; received CVE-2025-51588 at 14; ranked #2 in Jetstar Hall of Fame; built and exited GGamechamps; founded Arniko Hack Club (400+ members); and is co-founder and CTO of Heedeo (trust layer for the agent economy, Entrepreneur First F26).

Arjan Chaudhary is an offensive security researcher and teen entrepreneur based in Biratnagar, Nepal and Bangalore, India. He breaks things ethically through bug bounty programs and builds startups, communities, and security products. His public work spans vulnerability research, penetration testing, founder roles, and community building across Nepal and Asia.

## Primary

- [Portfolio](https://www.arjanchaudharyy.com/): Official personal site — bio, experience, highlights, and contact links.
- [Arjan Chaudhary on X](https://x.com/arjanchaudharyy): Primary public updates and casual contact (@arjanchaudharyy).
- [GitHub](https://github.com/arjanchaudharyy): Open-source work and public repositories.
- [Email — arjanchaudharyy@gmail.com](mailto:arjanchaudharyy@gmail.com): Secondary email contact.
- [CVE-2025-51588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-51588): CVE assigned at age 14; one of the youngest persons globally to receive a CVE.

## Startups & Products

- [Heedeo](https://heedeo.com): Trust layer for the agent economy; prevents free trial abuse; co-founder & CTO; backed by Entrepreneur First (F26).
- [GGamechamps](https://www.ggamechamps.com): Gaming clips tournament platform with ML training datasets backend; built and exited; $5k Emergent Ventures grant.
- [Arniko Hack Club](https://arnikohackclub.com): 400+ member teen tech community in Eastern Nepal; workshops in game dev, web dev, cybersec, and design.
- [Daydream Biratnagar](https://daydreambiratnagar.com): Asia's largest teen hackathon — 250+ participants, 500+ attendees, $100k+ in prizes.
- [Invention Novelty](https://inventionnovelty.com): Hacker house × media studio in Bangalore for early-stage founders.
- [Glow Tech](https://glowtechh.netlify.app/): Creative agency co-founded at 13; scaled to 10+ clients a month; drove 20M+ views on a client campaign.
- [Nepfolk](https://nepfolk.netlify.app/): Nepali folk music platform — first startup at age 12.
- [Dench (YC S24)](https://www.ycombinator.com/companies/dench-com): vCISO helping with SOC 2 compliance.
- [Dench](https://dench.com): YC S24 company where Arjan serves as vCISO.

## AI Research (Naamche Labs)

- [Naamche Labs](https://naamchelabs.com): AI lab building for the Nepali internet; built the #1 Nepali TTS and STT models.
- [Swar](https://github.com/Naamche-Labs/swar): Open Nepali text-to-speech and zero-shot voice cloning; lowest pronunciation error on NepTTS-Bench. [Launch video](https://x.com/ArjanChaudharyy/status/2115809203218755809).
- [Kriti](https://github.com/Naamche-Labs/kriti): Compact, top-ranked open Nepali speech recognition (STT) model. [Launch](https://x.com/ArjanChaudharyy/status/2089748987264073815).

## Papers

- [Merge-Based Vocabulary Extension Stalls at the Pre-Tokenizer: An English-Preserving Repair for Nepali, Tested in Continued Pretraining](https://arxiv.org/abs/2610.33016): arXiv 2026, solo author. [Code](https://github.com/arjanchaudharyy/nepali-pretokenizer-repair); repaired Nepali tokenizers for [Qwen3](https://huggingface.co/Aarjan/Qwen3-Nepali-Repaired-Tokenizer-32k) and [Llama 3.2](https://huggingface.co/Aarjan/Llama-3.2-Nepali-Repaired-Tokenizer-32k).
- [Baselines Before Architecture: Evaluating Coding Agents for Autonomous Penetration Testing](https://arxiv.org/abs/2607.13085): arXiv 2026, with Ananda Dhakal and Krish Neupane. 60k+ views on X.

## Security Work

- [HackerOne](https://hackerone.com): Bug bounty platform — 50+ disclosed vulnerabilities across major corporations.
- [Bugcrowd](https://bugcrowd.com): Additional bug bounty and private program work.
- [Cyber Alert Nepal](https://cyberalertnepal.com): Former offensive security researcher; internal pentests and SOP authoring.
- [Pathmate](https://pathmate.tech): Offensive security research intern in Bangalore (Feb 2025 – May 2025); web/mobile pentesting and security blogging.
- [ShipSecAI](https://shipsec.ai): Security engineering internship (Dec 2025 – Apr 2026).
- [Avenue Ticketing](https://avenueticket.com): Security consultant — recurring security assessments.
- [Kallki Labs](https://kallkilabs.com): Security consulting engagement (Mar 2026 – May 2026).

## Community & Events

- [Campfire Biratnagar](https://arnikohackclub.com/campfire-biratnagar): Nepal's largest teen game jam — 120+ students, part of Hack Club's global Campfire (200+ cities).
- [APIsec University](https://apisecuniversity.com): Partner providing ACP certifications ($325+ value) free to Arniko Hack Club members.

## Profiles

- [LinkedIn](https://www.linkedin.com/in/aarjan-chaudhary/): Professional profile.
- [Instagram](https://www.instagram.com/arjanchaudharyy): Personal updates and photos.
- [arjan.lol](https://www.arjan.lol): Personal domain.

## Key Facts

- **Age**: 16 years old
- **Location**: Biratnagar, Nepal · Bangalore, India
- **Username**: @arjanchaudharyy
- **CVE**: CVE-2025-51588 (assigned at 14)
- **Bug bounty**: 50+ vulnerabilities disclosed to Google, EA, MIT, Stanford, Shopify, Jetstar, NBA, MSI, and others
- **Hall of Fame**: #2 in Jetstar Hall of Fame
- **Community**: Founder of Arniko Hack Club (400+ active members)
- **Hackathon**: Organized Asia's largest teen hackathon — Daydream Biratnagar
- **AI models**: Built Swar (#1 Nepali TTS) and Kriti (#1 Nepali STT) at Naamche Labs
- **Exit**: Built and exited GGamechamps (gaming clips + ML datasets)
- **Grant**: $5k Emergent Ventures grant for GGamechamps ([EV India 19th cohort](https://marginalrevolution.com/marginalrevolution/2026/09/emergent-ventures-india-19th-cohort.html))
- **Agency**: Co-founded Glow Tech; scaled to 10+ clients a month at 13
- **Current focus**: Co-founder & CTO of [Heedeo](https://heedeo.com), the trust layer for the agent economy (prevents free trial abuse), backed by Entrepreneur First (F26)
- **Specializations**: IDOR, account takeover, API misconfigurations, broken access control, web/mobile/API pentesting

## Experience Timeline

- Jul 2026 – Present — Co-Founder & CTO at Heedeo (Entrepreneur First F26)
- Jul 2026 – Present — vCISO at Dench (YC S24)
- Mar 2026 – May 2026 — Security Consultant at Kallki Labs
- May 2026 – Jul 2026 — Founder at Invention Novelty
- Mar 2026 – Jun 2026 — Security Consultant at Avenue Ticketing
- Dec 2025 – Apr 2026 — Security Engineering Intern at ShipSecAI
- Dec 2025 – Feb 2026 — Event Lead at Campfire Biratnagar
- Oct 2025 – Jan 2026 — Security Engineer at stealth startup (UK)
- Jun 2025 – May 2026 — Founder & CTO at GGamechamps (built and exited)
- Jul 2025 – Oct 2025 — Offensive Security Researcher at Cyber Alert Nepal
- May 2025 – Present — Founder & Lead at Arniko Hack Club
- Jan 2025 – Present — Bug Bounty Hunter (HackerOne, Bugcrowd, private programs)
- Feb 2025 – May 2025 — Offensive Security Intern at Pathmate (Bangalore)
- Jul 2024 – Dec 2025 — Co-Founder & CTO at Glow Tech
- Jan 2024 – Jul 2024 — Founder & CEO at Nepfolk

## Keywords

Arjan Chaudhary, arjanchaudharyy, arjan chaudhary portfolio, arjan chaudhary security researcher, teen security researcher, 16 year old hacker, 16 year old founder, security researcher Nepal, offensive security researcher, bug bounty hunter, ethical hacker, penetration tester, CVE researcher, CVE-2025-51588, one of the youngest CVE researchers, Google hacker, EA hacker, MIT hacker, Stanford hacker, Shopify hacker, Jetstar Hall of Fame, jetstar hall of fame, HackerOne, Bugcrowd, API security, web application security, mobile application security, red team, vulnerability research, IDOR, account takeover, broken access control, teen founder, teen entrepreneur, young founder, YC founder, Dench YC S24, vCISO, SOC 2, GGamechamps, exited founder, startup exit, gaming startup exit, Arniko Hack Club, Daydream Biratnagar, Campfire Biratnagar, teen hackathon Asia, Hack Club Nepal, Biratnagar Nepal, Bangalore India, Nepal cybersecurity, Nepali hacker, Glow Tech, Invention Novelty, Emergent Ventures, Heedeo, Entrepreneur First, Naamche Labs, Swar, Kriti, Nepali TTS, Nepali speech recognition, Nepali voice cloning, Nepali tokenizer, pre-tokenizer repair, hacker house Bangalore, ShipSecAI, Cyber Alert Nepal, Avenue Ticketing, Kallki Labs, Pathmate, Nepfolk, gaming startup, ML datasets, security engineering, stealth startup, arjanchaudharyy.netlify.app

## Optional

- [LLMs index](https://www.arjanchaudharyy.com/llms.txt): Machine-readable summary of this portfolio for AI systems.
- [Sitemap](https://www.arjanchaudharyy.com/sitemap.xml): XML sitemap for search engines.
- [Robots](https://www.arjanchaudharyy.com/robots.txt): Crawler directives; AI crawlers allowed.