Research

Real findings. Real sector-level scans. Real CVE writeups.

Anonymised research from the Dhara pipeline. Framework-specific patterns we see over and over again.

Apr 12, 2026ABHA-FHIR
What every ABDM integrator leaks at /fhir/metadata
The FHIR CapabilityStatement endpoint is the first thing an attacker looks at on an ABDM integrator. A survey of public-facing metadata across 30 integrators shows consistent, avoidable over-sharing — and what a clean CapabilityStatement should look like.