Mufeed VH
| Mufeed VH | |
| Occupation | CEO and co-founder of Winfunc |
|---|---|
| Known for | Winfunc (YC S24), Devika (open-source AI software engineer) |
| Website | mufeedvh.com |
Mufeed VH is an Indian software developer and cybersecurity researcher who is the CEO and co-founder of Winfunc, an AI-native security auditing company that participated in Y Combinator's Summer 2024 batch.[1] He is from Thrissur, Kerala, and is based between San Francisco and Kerala.
Career
Early career and cybersecurity
Mufeed VH established himself in the cybersecurity field at a young age. He represented India at the WorldSkills Olympiad in Cyber Security, where he placed eighth, and won a Bronze Medal at the BRICS Skills Olympiad in Cyber Security. He also won the Gold Medal at the IndiaSkills Nationals in Cyber Security. Over the course of his career, he has patched and reviewed over 300 CVEs in open-source software and has identified security vulnerabilities in companies including Google, Mastercard, Okta, Dell, Ford, and others through bug bounty programs.
He previously operated a research consultancy company called Lyminal, where he worked on software problems for clients.
Devika
In early 2024, Mufeed gained widespread media attention for creating Devika, an open-source AI software engineer positioned as an alternative to Cognition AI's Devin. The project was covered by outlets including NDTV, The Economic Times, and The Times of India. The Devika project is hosted on GitHub under the stitionai organization.
Winfunc
Mufeed co-founded Winfunc, which describes itself as an "AI Hacker" that autonomously finds, verifies, and patches security vulnerabilities in codebases. The platform combines static application security testing (SAST), dynamic application security testing (DAST), infrastructure-as-code (IaC) scanning, and software composition analysis (SCA) into a single AI-native auditing system. The company states that its agent performs context-aware scanning to identify business logic errors and generates reports with zero false positives.[2]
According to the company, Winfunc's agent has discovered real vulnerabilities in products and services maintained by Google, Supabase, Sentry, Cal.com, Gumroad, Bun, Hoppscotch, Anthropic, Brave, Microsoft, NVIDIA, and The New York Times, among others.
Other activities
Mufeed has given a TEDx talk and has won competitions including FOSSHack 2023. He received the Silver Medal in the Young Innovators Programme (YIP) of K-DISC, a programme run by the Government of Kerala. He maintains an active presence on GitHub with over 1,200 followers.
References
- ↑ "winfunc – Y Combinator". 'Y Combinator}'. Retrieved 2026-03-18.
- ↑ "Winfunc – Autonomous AI-native security audits". 'Winfunc}'. Retrieved 2026-03-18.