Open for freelance projects
Websites and apps that are secure by design.
I'm a full-stack developer and penetration tester in Bangladesh. I build it, I attack it, then I hand it over with the security notes.
A free Quran app for Windows, macOS and Linux. It follows the recitation word by word, offers 100+ reciters and works offline. Built with Svelte, TypeScript, Rust and Tauri.
Secure by design. There are no accounts, ads or tracking, so there is no user data to leak. It's open source under GPL-3.0, so anyone can read what it does.
Automated four-channel plant irrigation. A Jetpack Compose Android app talks to ESP32 firmware over WebSocket, REST and Bluetooth setup. Delta flash writes cut memory wear by over 75%. The source is private.
Secure by design. Pumps start switched off, the API is PIN-protected, and failsafes cover the failures you don't plan for.
Turns an academy's Google Sheets into KPIs, charts and filters, in daily use at Hacktolive Academy. Built with Google Apps Script and Chart.js.
Secure by design. It runs entirely on Google Apps Script, so there is no server of mine to patch or expose.
Upload a CSV, map the columns, and get ready-made scripts that fill registration forms. JavaScript with SQLite storage.
Secure by design. It ships as a Docker container with its own storage, and it only ever handles the data you upload.
Proxmox and OpenWrt, where I test detection and secure remote access before I recommend either to a client.
Secure by design. Wazuh watches for intrusions, DNS is encrypted with DoH, and remote access goes through Tailscale ACLs.
This site sends the same protections I set up for clients. Press the button and your browser asks this page for its own security headers.
Websites and web appsSvelte, TypeScript, plain HTMLA fast site that is hard to break
Android appsKotlin, Jetpack ComposeAn app with safe defaults
Desktop appsRust, TauriA small, offline-first app
Python automationScrapers, bots, reportsHours of work done for you
Google WorkspaceApps Script, Sheets, Gmail, DriveWorkflows that run themselves
Pipelinesn8n, scheduled jobsData that moves on its own
Security reviewThreat model, manual testingA fix list in plain language
HardeningHeaders, auth, secrets, accessA written note at handover
To begin, we agree what the thing does, what data it touches and what could go wrong. That list shapes everything after it.
Then, I build in small releases you can try. Each one gets a security review before the next starts.
Before launch, I attack the finished product the way a stranger would, and fix whatever gives way.
At handover, you get the code, the documentation and a short written security note you can show anyone who asks.
Fahim Shahriar learned security by breaking things in labs, so he builds with authentication, least privilege and safe defaults from the first commit.
200+ TryHackMe rooms, 3+ VulnHub machines, a contributor at Hacktolive Academy, and a homelab running since 2023. Junior Penetration Tester (PT1) completed, eWPTv2 in progress, CPTS planned for 2027 and OSCP for 2028.
I reply within a day or two. Say what you need built, automated or tested, and roughly when. Or write to fahimonlinux@gmail.com.