Smart Contracts · DeFi · Web / AppSec · LLM Security · Karachi, Pakistan 🇵🇰
I'm a security researcher focused on smart contracts and web3, with a background in offensive security and LLM red-teaming. I go after the bugs that survive audits broken access control, accounting & invariant defects, and logic flaws that move real funds and I don't report anything without a runnable proof-of-concept. Equally comfortable breaking systems and building the tooling to keep them honest.
- Smart Contract / DeFi — Solidity · EVM · access control · accounting & invariant bugs · liquidation / collateral logic · Foundry PoCs
- Web / AppSec — IDOR & broken access control · SSRF · auth / identity-verification bypass · business-logic flaws
- LLM Security — prompt injection · guardrail bypass · red-teaming RAG & agent systems
- sky-dodger — browser airplane game — HTML5 Canvas + vanilla JS,
requestAnimationFrameloop, momentum flight, procedural obstacles, GitHub Pages deploy.JavaScript - snake-java — classic Snake in Java 17 + Swing with a fully GUI-independent, unit-tested engine (26 tests, zero deps, CI) — clean OOP, O(1) collision via
ArrayDeque+HashSet.Java - ghostshield — an LLM security scanner that fires real prompt-injection attacks at a model and reports what gets through.
TypeScript - ghost-resource-tracker — detects hidden cryptominers by power signature — threat scoring + Shannon entropy.
Python - Open-source security research — reviewing Google OSS internals (Timesketch · GRR) for security issues.
- RabbitHole — THM Writeup — hands-on exploitation walkthrough.
CTF
*Signal over noise · PoC or it didn't happen · Instruments, not dashboards.*