Skip to content
View 0hardik1's full-sized avatar
8 followers · 0 following

Achievements

Achievement: StarstruckAchievement: Pair Extraordinairex4Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Achievements

Achievement: StarstruckAchievement: Pair Extraordinairex4Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Block or report 0hardik1

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
0hardik1/README.md

Hi, I'm Hardik 👋

I do platform security: securing the cloud and compute foundations every product team builds on, so the safe path is the default path.

At Block, I secure the platform shared by Square, Cash App, and Afterpay: multi-tenant Kubernetes (60+ clusters, thousands of services) on an AWS organization of roughly 10,000 accounts. The work spans three layers:

  • Cloud security. Foundational AWS controls at organization scale: service control policies (SCPs) and resource control policies (RCPs), data perimeters, permission boundaries, Golden-AMI enforcement across ~10,000 accounts, IAM-authenticated service networking for Block's AWS VPC Lattice adoption, and least-privilege IAM reduction driven by real usage data.
  • Compute security. Kubernetes admission control (OPA/Rego), container image signature and build-attestation verification with Sigstore/Cosign across all Block Kubernetes platforms, workload isolation with gVisor, and hardening the Terraform CI/CD pipelines that deploy our infrastructure. Earlier: the security roadmap for Twitter's ~200k-node Kubernetes migration, and Twitter's Kubernetes Security Standard.
  • Securing AI agents. Agentic workloads are the newest untrusted tenant on every platform. Some of the open-source work below is about giving them isolation and least-privilege paths.

Underneath: a decade of threat modeling and security design review at Block, Twitter, Salesforce, and Synopsys.

Open Source

Recent platform-security work across cloud, compute, and AI-agent security:

  • kubesplaining stars Kubernetes security assessment CLI that maps multi-hop RBAC privilege-escalation paths to cluster takeover.
  • awsmux stars CLI that runs one AWS command across hundreds of accounts in parallel, with a built-in MCP server for AI agents.
  • rbac-why-can-i stars kubectl plugin that traces why an RBAC permission is granted, showing the exact Role/Binding chain.
  • agentmoat: moves Kubernetes workloads from runc to gVisor to blunt container-escape, safely and reversibly.
  • eks-identity-migrator: audits IRSA usage and migrates EKS clusters to Pod Identity with verification and rollback.
  • eks-scp: highest-impact AWS Organizations SCPs for EKS, built on the EKS IAM condition keys.

Writing

Credentials

OSCP  |  Advanced Cloud Security Practitioner (CSA)  |  M.S. Cyber Security, NYU

Stack

Go  |  Python  |  Rego  |  Terraform  |  Kubernetes  |  AWS  |  OPA/Gatekeeper

Pinned Loading

  1. kubesplaining kubesplaining Public

    Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

    Go 95 7

  2. awsmux awsmux Public

    Run one AWS CLI command across hundreds of AWS accounts in parallel. MCP built in for AI agents.

    Go 29 1

  3. rbac-why-can-i rbac-why-can-i Public

    A kubectl plugin that explains WHY a permission is granted in Kubernetes RBAC by showing the exact Role/ClusterRole + Binding chain.

    Go 17 2

  4. agentmoat agentmoat Public

    agentmoat moves Kubernetes workloads from the default runc runtime to gVisor (runsc), the user-space kernel that defends against the kernel-exploit step of a container-escape chain.

    Go 2

  5. eks-identity-migrator eks-identity-migrator Public

    Audit IRSA usage and migrate Amazon EKS clusters to Pod Identity, with verification and rollback.

    Python

  6. eks-scp eks-scp Public

    Highest-impact AWS Organizations SCPs for Amazon EKS, built on the EKS IAM condition keys.