01 / software
Software Development
Six years of building corporate systems with PHP and Laravel: e-commerce, CRM, payment integrations, IoT dashboards. Lately I have been working with TypeScript and Go.
➜ ~/whoami
CAN TÜRK
<
Backend Developer
/>
I'm a backend developer focused on application security at Kuark. I write APIs, then try to break them and report what I find. The rest of my time goes into logos and interfaces for brands.
disciplines
I do all three
at once.
I can take a job from end to end on my own: from the database schema to the logo, from the penetration test to the ad creative.
02 / design
Brand & Corporate Identity
From a new business's logo to its business cards, from social media templates to ad creatives, I build the whole visual identity — and design the product interface from the same hand.
03 / security
Cyber Security
At Kuark I test applications against OWASP Top 10 and SANS 25 and wire SAST/DAST tools into the CI/CD pipeline. Two flaws I found in software I reviewed on my own became CVE records.
selected works
Featured
projects.
security research
Flaws I
reported.
When I find a flaw in software I use, I tell the vendor. Two of those became CVE records.
CVE-2026-28403
7.6 HIGH
Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server accepted connections from any origin without validating the HTTP Origin header during the handshake. A…
Textream (macOS) < 1.5.1 March 2026 detay ↗
CVE-2026-28412
6.5 MEDIUM
Resource exhaustion through unlimited connections (DoS)
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server imposed no limit on concurrent connections. Combined with a broadcast timer sending state to all…
Textream (macOS) < 1.5.1 March 2026 detay ↗
6+
years of experience
2
CVE records
10
open-source repos
8
certifications
// got a new project?
Let's work together.
A project, a collaboration or just a technical question. I usually reply the same day.