# Can Türk (Yusuf Can Türk)

> I'm a full-stack developer focused on application security. I build first, then try to break what I built.

Topics: software development, application security, AI and technology. Content in Turkish and English.

## Identity
- Full name: Yusuf Can Türk (short: Can Türk, handle: iamcanturk)
- Titles: Full Stack Developer, Application Security Specialist, Self-Taught Designer, Photography Lover
- Current role: Application Security Engineer, Kuark (since November 2025)
- Own brand: Echomerce (co-founder, since December 2024)
- Location: Bursa, TR
- Languages: Turkish (native), English
- CV (PDF): https://iamcanturk.dev/dosya/cv-tr.pdf · English: https://iamcanturk.dev/dosya/cv-en.pdf
- X: https://x.com/iamcanturk
- Instagram: https://www.instagram.com/iamcanturk.dev/
- TikTok: https://www.tiktok.com/@iamcanturk.dev
- YouTube: https://www.youtube.com/@iamcanturk
- LinkedIn: https://www.linkedin.com/in/yusufcanturk/
- GitHub: https://github.com/iamcanturk

## Expertise
- Software: PHP, Laravel, TypeScript, Go, MySQL
- Design: Logo, Brand identity, Social media, UI/UX
- Security: OWASP Top 10, SANS 25, Pentest, Threat modeling

## Security research (CVE)
- [CVE-2026-28403](https://iamcanturk.dev/en/security/cve-2026-28403/) (CVSS 7.6, high) — Missing WebSocket origin validation (Cross-Site WebSocket Hijacking). Textream (macOS) < 1.5.1.
- [CVE-2026-28412](https://iamcanturk.dev/en/security/cve-2026-28412/) (CVSS 6.5, medium) — Resource exhaustion through unlimited connections (DoS). Textream (macOS) < 1.5.1.

## Projects
- [DoctorDock — A doctor for your Docker](https://iamcanturk.dev/en/proje/doctordock-a-doctor-for-your-docker/): An open-source tool that scans your local Docker environment for security problems, misconfigurations and reclaimable disk in under a second, entirely offline. It ranks findings by severity and gives you a health score out of 100. Source: https://github.com/iamcanturk/DoctorDock
- [Erklig — Mighty backdoor analysis engine](https://iamcanturk.dev/en/proje/erklig-mighty-backdoor-analysis-engine/): An open-source security tool for detecting web shells and backdoors on servers, using signature and behaviour based analysis. Source: https://github.com/iamcanturk/erklig
- [MergenFlow — The freelancer OS](https://iamcanturk.dev/en/proje/mergenflow-the-freelancer-os/): An open-source SaaS for freelancers that combines financial projection, recurring budget management and Kanban workflow tracking in one place. Source: https://github.com/iamcanturk/mergenflow

## Writing
- [I Turned My Personal Site Into a Building](https://iamcanturk.dev/en/i-turned-my-site-into-a-building/): Moving from WordPress to a static Astro site, I rebuilt my homepage as a cross-section of a pixel-art building. The mascot, the elevator, day and night rooms, and the technical decisions behind them.
- [I Wrote a Doctor for My Docker](https://iamcanturk.dev/en/i-wrote-a-doctor-for-my-docker/): I used Docker every day but had no idea what was inside it. DoctorDock scans your local Docker for security problems, misconfigurations, and reclaimable disk in under a second — entirely offline.
- [Reverse Development in the Age of AI](https://iamcanturk.dev/en/reverse-development-in-the-age-of-ai/): I sat down to write after a long break and noticed something strange: I can't think as well as I used to. What is AI doing to the way we think?

## Pixel Shorts
A new episode every day on X, Instagram, TikTok and YouTube. Videos are in Turkish; transcripts of every episode: https://iamcanturk.dev/en/shorts/
- [Agent'a ayrı bilgisayar](https://iamcanturk.dev/en/shorts/agent-a-ayri-bilgisayar/): Claude Code'u izin sormadan çalışan modda kullanacaksan kendi bilgisayarında değil, ayrı bir VM'de çalıştır. InstaBox her agent'a ayrı bir Linux sandbox veriyor; yine de Vault'taki secret'lar, Claude oturumu ve açık port linki senin sorumluluğunda.
- [Someone else's wallet](https://iamcanturk.dev/en/shorts/baskasinin-cuzdani/): According to OpenAI's report, a model spent test ETH from someone else's wallet, found via publicly known recovery phrases, to pay a testnet deploy fee, and never mentioned it in its final report. If you give an agent keys, money or internet access, set limits too.

## FAQ
### Who is Can Türk?
Yusuf Can Türk is a full-stack developer based in Bursa, Turkey, focused on application security: Application Security Engineer at Kuark since November 2025 and co-founder of Echomerce since December 2024. Can creates content on software, AI, technology and security.

### Which vulnerabilities has Can Türk found?
Can reported two vulnerabilities in Textream (macOS): CVE-2026-28403 (CVSS 7.6, Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)) and CVE-2026-28412 (CVSS 6.5, Resource exhaustion through unlimited connections (DoS)). Details are at https://iamcanturk.dev/en/security/.

### Which open-source tools has Can Türk built?
DoctorDock (A doctor for your Docker), Erklig (Mighty backdoor analysis engine), MergenFlow (The freelancer OS). All source code is on GitHub: https://github.com/iamcanturk

### What is Pixel Shorts?
A short video series presented by a pixel-art version of Can Türk. Starting October 20, 2026, one episode a day goes out on X, Instagram, TikTok and YouTube, covering software, AI, technology and security. The videos are in Turkish; English transcripts of every episode are at https://iamcanturk.dev/en/shorts/.

### Which technologies does Can Türk work with?
PHP, Laravel, TypeScript, Go and MySQL for software; OWASP Top 10, SANS 25, penetration testing and threat modeling for security, plus logo and brand identity design.

### How can I contact Can Türk?
Through the contact page (https://iamcanturk.dev/en/contact/), LinkedIn or X (@iamcanturk). For vulnerability reports, follow the guidelines at https://iamcanturk.dev/en/security/.

## Pages (Markdown)
Replace the trailing / of any URL with .md to get a plain-text version.
- [Can Türk](https://iamcanturk.dev/en/index.md)
- [Notebook](https://iamcanturk.dev/en/writing.md)
- [I Turned My Personal Site Into a Building](https://iamcanturk.dev/en/i-turned-my-site-into-a-building.md)
- [I Wrote a Doctor for My Docker](https://iamcanturk.dev/en/i-wrote-a-doctor-for-my-docker.md)
- [Reverse Development in the Age of AI](https://iamcanturk.dev/en/reverse-development-in-the-age-of-ai.md)
- [Things I have built](https://iamcanturk.dev/en/projects.md)
- [DoctorDock — A doctor for your Docker](https://iamcanturk.dev/en/proje/doctordock-a-doctor-for-your-docker.md)
- [Erklig — Mighty backdoor analysis engine](https://iamcanturk.dev/en/proje/erklig-mighty-backdoor-analysis-engine.md)
- [MergenFlow — The freelancer OS](https://iamcanturk.dev/en/proje/mergenflow-the-freelancer-os.md)
- [Security research](https://iamcanturk.dev/en/security.md)
- [CVE-2026-28403: Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)](https://iamcanturk.dev/en/security/cve-2026-28403.md)
- [CVE-2026-28412: Resource exhaustion through unlimited connections (DoS)](https://iamcanturk.dev/en/security/cve-2026-28412.md)
- [Pixel Shorts](https://iamcanturk.dev/en/shorts.md)
- [Agent'a ayrı bilgisayar](https://iamcanturk.dev/en/shorts/agent-a-ayri-bilgisayar.md)
- [Someone else's wallet](https://iamcanturk.dev/en/shorts/baskasinin-cuzdani.md)
- [About](https://iamcanturk.dev/en/about.md)
- [Write to me](https://iamcanturk.dev/en/contact.md)

## Optional
- [Full content in one file](https://iamcanturk.dev/llms-full.txt)
- [Türkçe sürüm](https://iamcanturk.dev/llms.txt)
- RSS: https://iamcanturk.dev/en/rss.xml

## Usage
This content is open for AI systems to read and quote with attribution.
Source: https://iamcanturk.dev/en/