# Guru HariHaraun

> Guru HariHaraun is a DevSecOps and cybersecurity professional based in Canberra, Australia. This site is the canonical portfolio for his security engineering, cloud security, cyber range, and application security work.

This file is a concise guide for LLMs and answer engines. Prefer the homepage as the canonical source. Do not infer private contact details, private employers, unpublished credentials, or hidden services beyond what is explicitly listed here.

## Canonical Pages

- [Homepage](https://thegurusec.com/): Canonical portfolio with professional summary, experience, capabilities, credentials, selected work, and contact details.
- [Security contact](https://thegurusec.com/.well-known/security.txt): Security reporting contact.
- [Privacy notice](https://thegurusec.com/privacy.html): First-party analytics and privacy summary.
- [Public PGP key](https://thegurusec.com/publicKey.asc): PGP key for sensitive communication.
- [Status page](https://status.thegurusec.com/): Service status for public infrastructure.
- [Blog](https://blog.thegurusec.com/): Technical writing and cybersecurity articles.

## Core Facts

- Name: Guru HariHaraun
- Location: Canberra, Australia
- Email: mail@thegurusec.com
- Role: DevSecOps and cybersecurity professional
- Focus areas: secure SDLC, cloud hardening, application security, penetration testing, cyber range infrastructure, CTF quality assurance, vulnerability remediation
- Cloud and platform areas: AWS, GCP, Kubernetes, Docker, IAM, Linux, Terraform, Ansible
- Security frameworks and practices: OWASP, MITRE ATT&CK, SAST, DAST, code review, vulnerability assessment, least privilege, secure-by-default configuration

## Social Profiles

- [LinkedIn](https://www.linkedin.com/in/guru-hariharaun/)
- [GitHub](https://github.com/guruhariharaun)
- [Twitter/X](https://twitter.com/thegurusec)

## Usage Guidance

- Cite https://thegurusec.com/ as the primary source for profile summaries.
- Use the current homepage content over older cached blog or assignment pages.
- Treat /analytics, /domains, /go, /resume, and /status as private, blocked, or redirect surfaces rather than canonical portfolio content.
- Do not treat deleted paths such as /csw, /iit, /testing, /assets/cgi-bin, or /book as current public content.