GitHub - mhsn1/mhsn1: Personal GitHub Profile – mhsnarf / Ethical Hacker

_{Smart Contracts · DeFi · Web / AppSec · LLM Security · Karachi, Pakistan 🇵🇰}

I'm a security researcher focused on smart contracts and web3, with a background in offensive security and LLM red-teaming. I go after the bugs that survive audits broken access control, accounting & invariant defects, and logic flaws that move real funds and I don't report anything without a runnable proof-of-concept. Equally comfortable breaking systems and building the tooling to keep them honest.

Focus

Smart Contract / DeFi — Solidity · EVM · access control · accounting & invariant bugs · liquidation / collateral logic · Foundry PoCs
Web / AppSec — IDOR & broken access control · SSRF · auth / identity-verification bypass · business-logic flaws
LLM Security — prompt injection · guardrail bypass · red-teaming RAG & agent systems

🎮 Play a game

✈️ Sky Dodger — a minimal HTML5 Canvas airplane game (vanilla JS, zero dependencies). Fly through the gaps and survive.

Selected work

sky-dodger — browser airplane game — HTML5 Canvas + vanilla JS, requestAnimationFrame loop, momentum flight, procedural obstacles, GitHub Pages deploy. JavaScript
snake-java — classic Snake in Java 17 + Swing with a fully GUI-independent, unit-tested engine (26 tests, zero deps, CI) — clean OOP, O(1) collision via ArrayDeque + HashSet. Java
ghostshield — an LLM security scanner that fires real prompt-injection attacks at a model and reports what gets through. TypeScript
ghost-resource-tracker — detects hidden cryptominers by power signature — threat scoring + Shannon entropy. Python
Open-source security research — reviewing Google OSS internals (Timesketch · GRR) for security issues.
RabbitHole — THM Writeup — hands-on exploitation walkthrough. CTF