Nisarga Adhikary, a 19-year-old ethical hacker, said he began examining the OSM evaluation portal after CBSE announced the system in February. Nisarga said the portal was publicly accessible and, while analysing the code, he discovered a hard-coded "master password" embedded in the system. He said he subsequently identified more than 45 vulnerabilities, documented them and reported to CERT-In.