Earlier this year, as the board rolled out on-screen marking (OSM) system— under which examiners grade scanned answer sheets online — Adhikary began probing the publicly accessible parts of the set-up. He says he found serious loopholes: a master password sitting in plain sight in the portal’s code, an OTP check that ran on the user’s own browser and a flaw that let one user retrieve another’s records.