Explained: How vulnerabilities in RBI’s bank.in registry exposed sensitive data for 13 months

Refer independent researcher Srikanth’s original resources here: [ Blogpost | PDF report | GitHub Repository ] “No security researcher reviewed this system before it went live. No independent auditor tested it. The RBI circular made adoption mandatory—but made security optional,” wrote Srikanth L, who runs Cashless Consumer , a consumer collective focused on digital payments, in his blogpost on how the RBI’s registry of ‘.bank.in’ domains was compromising sensitive data.