Apoorva Jois
Senior Security Engineer
Zepto
Apoorva is a Senior Security Engineer with 7+ years of experience in application security, offensive security, and security automation. Her work spans product security, API security, software supply chain security, and AI-driven security solutions. She is particularly interested in applying AI and automation to offensive security challenges, building practical tools that help identify vulnerabilities and accelerate remediation. Her work focuses on bridging the gap between security research and real-world defenses, making security more scalable and effective for engineering teams.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
PatchPilot: Your Co-Pilot for the Software Supply Chain
PatchPilot — autonomous SCA remediation that proves the fix actually matters.
Vulnerability scanners are brilliant at raising alarms and useless at answering the only two questions that matter: does this really affect me, and how do I fix it? PatchPilot answers both — automatically.
Hand it a finding from any scanner — Trivy, Grype, Snyk, or GitHub Advanced Security — and it gets to work: clones the repo, applies the right version bump (manifest and lockfile) across seven ecosystems, and proves whether the vulnerable code is even reachable — govulncheck symbol traces for Go, Semgrep taint paths for JS/Python. It runs your own test suite before and after to guarantee nothing breaks, then opens a merge-ready PR that carries the whole story: reachability verdict with call-site evidence, blast radius, supply-chain audit, and a reviewer checklist.
The payoff is security that scales. The triage-bump-test-PR grind that eats an engineer's afternoon per CVE, PatchPilot does in minutes — and because each run fixes exactly one finding, it parallelizes cleanly: point a CI matrix or a pool of workers at your backlog and a thousand CVEs collapse into a thousand reviewed pull requests, not a quarter of manual toil. Mean-time-to-remediate drops from weeks to a coffee break.
Built to run in a hostile environment — hardened against prompt injection, malicious install scripts, and SSRF at every step. Apache-2.0. Scanner-agnostic. Finding to fix in under five minutes.
- 13:00
- Tue
- 01 Dec
Stage:
Arsenal 2
Sessions Type:
Keynote