Skip to content
View iamcanturk's full-sized avatar
🎯
Focusing
🎯
Focusing
45 followers · 99 following

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Highlights

  • Pro

Block or report iamcanturk

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
iamcanturk/README.md

whoami: Can Türk. Full-stack developer focused on application security. I build first, then try to break it. Bursa, TR · AppSec Engineer @ Kuark

Website: iamcanturk.dev X: @iamcanturk Instagram: @iamcanturk.dev TikTok: @iamcanturk.dev LinkedIn: yusufcanturk

I'm a full-stack developer focused on application security, working as an
Application Security Engineer at Kuark in Bursa, Türkiye.
I build first, then try to break what I built, and I tell the vendor when I find a hole in software I use.
The rest of the time I design the brands and interfaces that sit on top of it all.

TR · Uygulama güvenliğine yoğunlaşmış bir fullstack geliştiriciyim. Önce yazıp sonra kırmayı deniyorum.


ls ~/projects: Things I have built (4 projects)

Pixel mascot wearing a radio headset
MorseForge
Learn Morse code by ear 		Pixel mascot at a desk with a monitor
DoctorDock
A doctor for your Docker
A free Morse code trainer that teaches by ear instead of from a chart, and runs entirely in the browser with no account. The front page is the first lesson: tap the key once and you have sent E. Straight key and iambic paddles, a daily wire and a 60-second test.

Astro TypeScript Web Audio PWA MIT
morse.iamcanturk.dev · project page 		Scans your local Docker environment for security problems, misconfigurations and reclaimable disk in under a second, entirely offline. Ranks findings by severity and gives you a health score out of 100.

Go Docker macOS MIT
doctordock.iamcanturk.dev · project page
Pixel mascot with a magnifying glass
Erklig
Mighty backdoor analysis engine 		Pixel mascot with a laptop and a coffee
MergenFlow
The freelancer OS
An open-source tool for detecting web shells and backdoors on servers, using signature and behaviour based analysis. Fast triage during penetration tests and incident response.

Go DFIR Pentest
project page 		An open-source SaaS for freelancers that combines financial projection, recurring budget management and Kanban workflow tracking in one place. In development.

TypeScript SaaS
project page

Most of my client and enterprise work is under NDA. These are the ones I can share openly.


nmap -sV ~/findings: Security research (2 CVEs)

When I find a vulnerability in software I use, I tell the vendor. Once a fix ships, I publish it.

CVEVulnerabilityCVSSAffectedReferences
CVE-2026-28403 Missing WebSocket origin validation
Cross-Site WebSocket Hijacking		 CVSS 7.6 HIGH Textream (macOS) < 1.5.1 Write-up · NVD · GHSA
CVE-2026-28412 Resource exhaustion through unlimited connections
Denial of Service		 CVSS 6.5 MEDIUM Textream (macOS) < 1.5.1 Write-up · NVD · GHSA

./pixel-shorts --all: Pixel Shorts (30 episodes)

Pixel mascot presenting 30 seconds a day on software, AI, tech and security.
Short pixel-art videos: vibe-coding pitfalls, password managers, AI agents, famous moments in tech history and a Republic Day special. The videos are in Turkish; every episode's script and checklist live on the site.

Starts 20 Oct 2026  iamcanturk.dev/en/shorts →
Watch on X · Instagram · TikTok
TR · Her gün 30 saniyede yazılım, yapay zekâ, teknoloji ve güvenlik.

cat ~/notes/*.md: Notebook (2 posts)

Long-form notes on security, software and AI.

Subscribe via RSS.


whoami --long: What I do

software   PHP · Laravel · TypeScript · Go · MySQL
security   OWASP Top 10 · SANS 25 · Pentest · Threat modeling
design     Logo · Brand identity · Social media · UI/UX

PHP Laravel TypeScript Go MySQL Docker


It started with running network cables in 2015; today I report CVEs.
iamcanturk.dev · projects, writing and how to reach me.

Pinned Loading

  1. DoctorDock DoctorDock Public

    Local-first Docker diagnostics — find security problems, misconfigurations and reclaimable resources. No AI, no network calls, no telemetry.

    Go

  2. erklig erklig Public

    ⚔️ ERKLIG - Mighty Backdoor Analysis Engine | Open-source web shell & backdoor detection tool

    Go

  3. mergenflow mergenflow Public

    MergenFlow Pro: The Ultimate Freelancer OS. An open-source SaaS platform offering comprehensive Financial Projection, Recurring Budget Management, and integrated Kanban Workflow Tracking for freela…

    TypeScript 1

  4. morseforge morseforge Public

    Learn Morse. Build the Signal. — a free, gamified Morse code trainer with a real CW audio engine, keyboard straight key, and a Signal Tree that lights up as you master each character.

    TypeScript 2 1