Security researcher and full-stack developer based in Istanbul. I started in security and now split my time between offensive and defensive tooling and web/mobile product work. Most of what I build ends up here as small, single-purpose tools with real tests and no fluff.

AI and LLM security

• sift - scans AI agent instruction files (CLAUDE.md, .cursorrules, mcp.json) for hidden or planted instructions. pip install siftscan
• ajar - finds exposed, unauthenticated local AI servers (Ollama, ComfyUI, vLLM, ...). Single binary, Go.
• ward - a security-review skill pack for AI coding agents.

CI/CD and supply chain

• cicheck - security linter for GitLab CI, CircleCI, Azure, Bitbucket, Drone, Travis. pip install cicheck
• depsweep - supply-chain risks in npm/pip dependencies: install hooks, typosquats, insecure sources. pip install depsweep
• dockaudit - Dockerfile and docker-compose security. Single binary, Go.
• extsweep - browser extension auditor: risky permissions and known-malicious IDs. Single binary, Go.
• KodGozu - AST-based static application security testing (SAST) for Python.

Network defense

• vigil - network intrusion detection engine: live/pcap capture, signature and behavioral detectors, correlation, and a dashboard with a JWT API.
• network-analysis-panel - visualizes live network traffic on a geographic map and interactive panels.

Malware and binary analysis

• hullscan - static triage for Windows executables: packing, injection APIs, hidden payloads, dangerous strings and Authenticode checks. C++20, no dependencies.

Web, recon and hardening

• spill - API keys and secrets left in a site's client-side code. Single binary, Go.
• subtakeover - subdomain takeover scanner, CNAME fingerprints confirmed with a live HTTP check.
• wraith - HTTP header/TLS/port misconfiguration scanner.
• urlgrave - historical URL/subdomain harvester (Wayback + crt.sh).
• subrecon - subdomain enumeration.
• pathbrute - HTTP directory/path brute-forcer with soft-404 filtering.
• jwtlint - offline JWT analyzer: alg:none, RS/HS confusion, kid injection, weak secrets. pip install jwtlint
• sshield - SSH server/client configuration hardening audit. pip install sshield
• leakscan - secret/API-key scanner for local files.
• cellar - local encrypted secrets vault.
• WebConfig-Analyzer - fast scanner for web server security misconfigurations.

Game servers

• fxsweep - FiveM server backdoor scanner: Cipher/Blum Panel loaders, encoded payloads, webhooks leaked to players. Single binary, Go.