He Knocked on Our Garage Door in 2016. Apple Put Him in Their Hall of Fame.
He had no experience in ethical hacking. No experience in hacking at all. And absolutely no background in coding, which made the whole conversation feel a bit surreal. I hired him for a year and told him I would not disturb him. Eighteen months later, he booked a 10-day London trip for ten people for Rs 1... by finding a vulnerability in one of the world's biggest travel platforms. This is that story.
It was 2016. I was walking on the narrow lane in front of our garage office in Coimbatore when a young man approached me. He could not have been more than twenty. He had a small laptop bag on his shoulder and a directness in the way he spoke that I still remember.
Back then, we were paying Rs 4,500 a month for that garage space, and for the first three months, the only furniture we had was a plastic Nilkamal chair that wobbled if you leaned back too far. The neighborhood uncle used to park his scooter right blocking our entrance.
"Bro, I want to work in your company," he said.
I was a big astonished... people do not generally walk up to founders on the street to ask for jobs. I asked what he wanted to do.
"I want to become an ethical hacker."
It was way too early for our startup to even think about data security. We were not looking for one. Still, I asked a few questions.
Three questions. Three "No bro." And then a pause in which I genuinely do not know what happened inside my head. Something about the way he had walked up and said what he wanted... no resume, no LinkedIn profile, no intermediary... made me decide.
I purposefully gave him no tasks. I would check on him once a month... not to assign work, just to ask how things were going. What he did instead was send me regular updates on what he was learning. Every few weeks, a message. A link to a course he had found. A concept he had got his head around. A tool he had started practising with.
I am not sure why I still think about this specific period. Maybe it does not matter, but the silence from his end was actually reassuring.
He had found a vulnerability in the booking engine of one of the largest travel companies in the world and used it to book a complete 10-day trip to London for the entire team... flights, hotels, sightseeing... at a total cost of Rs 1. Not Rs 1 per person. Rs 1 total.
We obviously reported the vulnerability to the company and walked them through how to fix it. That was never a question; it was always going to be responsible disclosure.
Since then, he has helped identify bugs in some of the biggest platforms in the world. Working mostly from a small laptop and a mobile data connection. No corporate setup. No team. Just the will, and then the way.
Where there is a will, there is a way. I have heard this phrase many times and always found it mildly optimistic. I have seen it lived out once. It changed how I think about what a CV is actually measuring... and what it is missing.
The thing I keep thinking about is the three "No bro" answers. Every conventional hiring filter would have ended the conversation there. No experience, no skills, no formal background. The CV was empty. The will was not. And in the end, the will was the only thing that mattered... because everything else can be built, given enough time and someone willing to say: I will not disturb you, I will pay you, go and learn. It is the same reason I hire for trust over credentials — the CV measures what someone has done; it says almost nothing about what they will do when no one is watching.