I build tools that turn vague engineering risk into evidence you can inspect: deterministic findings, bounded workflows, and read-only diagnostics.
I am a Computer Programming student at Ondokuz Mayıs University in Samsun, Türkiye. Most of my projects begin as something I want to understand or use, then move beyond the demo stage through tests, documentation, CI, explicit limitations, and reproducible verification.
AI-assisted tools are part of my planning and implementation workflow, but they do not get the final say. Runtime behavior, automated checks, manual review, and honest evidence remain the release gates.
|
A deterministic, Next.js-focused security sanity check for pre-deploy review and CI. It finds common risk patterns and explains why they were flagged, without executing the scanned repository or using an LLM at runtime.
Current: v0.6.0 on npm · 25 rules · 600 testsUse it: npx one-off scans · compact --summary output · SARIF · Action v1.2.0 via @v1Proof: GitHub CI green · secure fixture 99/100 · vulnerable fixture 26 findingsTypeScript AST-assisted bounded flow
View repository → |
Adds a bounded control plane around Codex: approve the scope, execute in an isolated worktree, verify outside the model loop, require independent review, and leave a portable receipt.
Current: v0.14.0 · npm stable · GitHub stable releaseFlow: plan → approve → execute → verify → reviewer PASS → receipt → finalizeNode.js 22+ Codex plugin local MCP
View repository → |
|
Explains why Linux screen sharing, file choosers, and screenshots fail by reconstructing XDG portal routing and checking D-Bus, systemd, PipeWire, and WirePlumber. Read-only by design, with no telemetry or runtime AI.
Current: v0.2.1 · crates.io · Linux x86_64 binaryDemo: slow, readable terminal flow · 20 findingsRust 2024 terminal + JSON + Markdown read-only
View repository → |
Inspects ZIP archives for path traversal, suspicious entries, extreme compression ratios, unsupported methods, and structural errors before extraction. Provides deterministic reports and policy gates as a Python library and CLI, installable from PyPI and ready for CI workflows.
Current: v0.5.0 alpha · PyPI · TestPyPI · GitHub release · wheel + sdistFlow: inspect → verify → safe-extractPython CLI safe extraction JSON + Markdown
View repository → |
| Project | Pull request | Focus |
|---|---|---|
| Ship Safe | #161 | MCP/OAuth security checks |
| OWASP Noir | #2657 | Vercel specification analyzer functional coverage |
| cargo-deny | #893 | Sparse registry matching for literal IP hosts |
| codex-with-chatgpt | #26 | OAuth pairing-page HTML hardening and browser security headers |
| gosec | #1733 | Deterministic, bounded taint caller traversal |
| Project | What it explores | Current state |
|---|---|---|
| BioVoid (private) | A local computational research prototype for reproducible full-heavy-atom protein-structure analysis and geometry-based pocket-candidate generation. Source, datasets, and research artifacts remain private while the study and independent review gates continue. | private research prototype |
| Nihongo Learn | Japanese learning for Turkish-speaking beginners: kana, SM-2 reviews, 31 lessons, mini stories, and N5-style practice. | usable local MVP |
Scientific boundary: BioVoid is an ongoing private research prototype. Its outputs are unvalidated geometry-based pocket candidates and diagnostics—not clinical, diagnostic, validated binding-prediction, drug-development, or discovery claims. Source, datasets, and intermediate research artifacts are intentionally private while the research continues.
Core
Runtime & application stack
Engineering tooling