Optimist Akademi
Paying client2026 sinceSpeeding up a WordPress / LearnDash education platform, migrating its server, hardening its security and building its management tooling. Engagement ongoing.
Visit site> Hi, I'm_
Computer Engineer | Cybersecurity Enthusiast
Istanbul, Türkiye — 41.0°N 29.0°E
> network scan … CLEAN
34
Project folders
TryHackMe Jr Penetration Tester Path45%
20+
Technologies used
2
Experience
[ 01 ] // Reference
Clients who agreed to be named appear here. The rest stay unnamed in the records cabinet below, as confidentiality requires.
Next in line: internships and employment
02Cyber4 IntelligenceCybersecurity InternJul 2025 (20 days)03Negzel TechnologySAP PI/PO InternAug 2025 – Sep 202504İŞKURIT SupportJan 2025 – Jun 2025
The logo is used with the client's knowledge and consent.
[ 02 ] // Showreel
Eight projects out of thirty-four folders, picked for the strength of their evidence. The diagrams beside each card are not screenshots — they are mechanism drawings showing how the thing actually works.
01Live, with real users· 4
Work with an address, opened and used by someone other than me. One is a paying client's platform; one publishes itself every morning.
Client workOpen it live
Optimist Akademi — platform speed-up
I sped up an online education platform that had gone years without measurement, writing every claim into a measurement log.
I converted the video payload that was bloating the homepage into a click-to-play cover system, cut CSS files from 68 to 7, and found and closed the root cause of the intermittent outages. Every interface change was installed so it could be reverted in seconds with a single switch — that is how you work on a live site without gambling with it.
- Measured
- Mobile PageSpeed 28 → 58, desktop 39 → 88; every figure is the median of three runs. Homepage ~14 MB → ~2 MB. Email deliverability score 5.6 → 8.7/10. A restore-from-backup drill was run and it succeeded.
- WordPress
- LearnDash
- PHP
- Cloudflare
- nginx
LiveOpen it live
Miri Parsel
Enter the deed area and it computes the net plot after statutory dedication, the floor-area ratio and the estimated buildable area, then hands you the poster text ready to paste.
It keeps candidate urban-renewal buildings in one list, runs the calculation chain through the zoning coefficients, and turns the result straight into poster copy. One codebase ships through three channels: a PWA on the phone, a Windows install, and a browser extension. It is a preliminary assessment tool — it does not replace an official zoning certificate.
- Measured
- 83/83 tests green, type-check and build clean. A real scan ran in production: 8 sources → 16 candidate buildings. All 15 defects found by an adversarial code review from three separate angles were closed.
- TypeScript
- React
- Vite
- Electron
- Chrome MV3
LiveOpen it live
Match Probability Panel
A mobile panel that shows a pick's measured probability and its sample size — and that never shipped the screen its own model failed to earn.
It puts probabilities computed from historical data next to the bookmaker's own price. The interface never says "guaranteed", "lock" or "certain"; every number carries its sample size, and below ten observations it says "insufficient data". In a blind test the model came in behind the market, so the planned value-bet screen was never built.
- Measured
- 230,557 matches imported with zero parse errors. Blind test over 13,775 matches: model Brier 0.5934 vs market 0.5784 (lower is better). The one model that came out positive is the first-half model — 0.66% calibration error over 13,774 matches.
- Next.js 16
- React 19
- Supabase
- Zod
- Vercel Cron
LiveOpen it live
Daily AI Discovery Letter
A publishing line, live to real subscribers, that sweeps nine sources every morning at 07:00 and boils the day down to six discoveries in one readable letter.
It collects candidates from GitHub, HuggingFace, academic papers, Hacker News and news feeds, then filters with deterministic scoring and a repetition penalty. The critical engineering decision: facts such as star counts, licence, price and install command are printed by code from measured data — the language model only writes the prose, never a number.
- Measured
- Log chain from a production run: 72 candidates → 57 fresh → 28 finalists → 6 winners. Archive: 42 HTML plus 38 Markdown letters and 3 audio briefings. 44 Python files / 7,891 lines. Measured cost: $2.80 for 12 letters.
- Python
- Claude API
- Telegram Bot API
- edge-tts
02The line that runs my own business· 2
Not scripts — end-to-end systems that gather data, verify it, decide, and report status. Both were built to run my own operation.
Internal systemSource closed
Freelance Hunter
A lead engine that scans job postings and the provable site defects of nearby businesses around the clock, and turns them into a sales card you can read down the phone.
One arm reads platform notification mail and official APIs, scores the postings and drops them into Telegram with a Turkish translation. The other audits business websites through public routes only, and proves every defect with a verification step the owner can confirm with their own eyes in ten seconds. The core rule is ban safety: nothing is scraped through a platform account, and a human always sends the message.
- Measured
- On the last run, 636 sites were audited out of a pool of 8,595 candidates, 443 were dropped and 193 warm leads remained. Independently verified: 18 of 18 "dead domain" findings, and 28 of 28 serious claims in the second round. Measured running cost: $3-6 a month.
- Python
- Next.js 16
- SQLite
- DuckDB
- Claude API
Internal systemSource closed
HQ Command Panel
A desktop panel that maps the whole project portfolio, measures whether each project actually runs, and starts a working session in that folder in one click.
It scans folders, probes processes and ports, and checks file freshness; to call a project "running" it has to see a process that really is. It infers links between projects strictly by evidence class — a link with no evidence is not drawn. Past 80% quota it locks expensive operations, and if quota cannot be measured it does not unlock.
- Measured
- Gates actually run: type-check clean · 45 JS tests ✅ · 59 Rust tests ✅ · production build ✅ · independent review with 0 critical / 0 high findings. 9,863 lines across 33 files. A sprite cache cut draw cost from 82% to 5%.
- Tauri 2
- Rust
- React 19
- Canvas 2D
03Interfaces and decision tools· 2
The visible face: an interface shipping in three languages, and a pure rule engine that has to decide in thirty seconds.
LiveOpen it live
This site
The personal showcase an employer or client walks around instead of reading a CV, shipping in three languages — the page you are on.
CV, skills, services and contact on one page, in Turkish, English and German across three separately indexable routes. The site is itself a piece of evidence: a nonce-based content security policy, browser permissions switched off, a hidden admin surface behind a signed session, and two working mini-apps embedded in it. The binding rule: every animation has a static alternative for low-powered devices and reduced-motion settings.
- Measured
- An external security assessment found no critical and no high findings. 151 source files, 96 components, 89/89 tests green. A 120-item interaction list closed 120/120.
- Next.js 16
- React 19
- TypeScript
- Tailwind 4
- framer-motion
Internal systemSource closed
MLBB Draft Coach
A fully rule-based draft advisor that tells you which character to take in the thirty-second pick/ban scramble — and why.
You mark the picks and bans you can see; the tool returns five suggestions for your role plus a list to avoid, justified by counters, synergy, team need and current meta. Every score carries the reason it got that score. The engine is purely rule-based — there is not a single AI call in the project.
- Measured
- 133 heroes · 61 items · 12 battle spells · 11 JSON files holding 485,417 bytes of data · 7 pure engine modules · 17 tests. The live data pipeline passed end to end; if a fetch stops halfway the existing data is not corrupted, because the write only happens when every fetch succeeded.
- TypeScript
- Next.js 16
- React 19
- Zustand
- Vitest
> every figure comes from a project record. Nothing unmeasured is called "working".
[ 03 ] // CV
Same history, five different emphases. All in Google's XYZ shape: result, measurement, method. All two pages; all generated from one data source, so no two can disagree on a date.
01 · Any posting
General
Software development and cybersecurity; breadth and measurement discipline in one document.
02 · SOC · Pentest · AppSec
Cybersecurity
Documented internship first; hardening on a live system, WAF, IP allowlist, restore drill.
03 · Frontend · Full-Stack
Full-Stack / Web
Production work in Next.js 16 and React 19 up front: trilingual site, three channels from one codebase.
04 · AI Engineer · Automation
AI and Automation
LLMs in production at a measured cost, fabrication-proof architecture: RAG engine, publishing line, lead system.
05 · For clients
Freelance
Written for a client, not an employer: service list, measured outcomes, how I work on a live site without risk.
> every figure in every CV comes from a project record; the source is shown on request.
KALI LINUX◆NMAP◆METASPLOIT◆WIRESHARK◆BETTERCAP◆PYTHON◆RED TEAM◆BLUE TEAM◆UNITY · C#◆NEXT.JS◆REACT◆SAP PI/PO◆RASPBERRY PI◆TRYHACKME◆
[ 01 ] // About
―
I'm a Computer Engineer working on cybersecurity, software development, and system automation. I've gained hands-on experience with Nmap, Metasploit, Python, SAP PI/PO, and AI projects. Now I want to join a team that builds secure, useful products.
>
0
Graduation year
0
Project folders
0+
Technologies used
A quick introduction — from the command line.
maksut@istanbul: ~
$
[ 02 ] // Skills
Cybersecurity, Unity, SAP PI/PO, and automation: the tools I use and the work I do.
Cybersecurity & Networking
Automation with Python
Building scripts for security workflows, threat analysis, and system optimization
System Security
A proactive security mindset on Linux-based environments, network analysis, and penetration testing methodologies
Kali LinuxNmapMetasploitWiresharkBettercap
Game Development
Unity & the C-family Ecosystem
Strong command of the Unity engine architecture, gameplay mechanics and object-oriented programming with C#/C++
Game Performance & UX
Improving game performance and building easy-to-use interfaces
Enterprise Software & Integration
System Integration
Managing data flow and SAP PI/PO processes within enterprise architectures
Analytical Problem Solving
Algorithm design, end-to-end software lifecycle, and code optimization grounded in Computer Engineering
Other Skills
IoT-based Automation
Smart home system setup, sensor integration, and home automation solutions
Web Development
Designing and building modern, responsive corporate and personal websites
Mobile App Development
UX-focused mobile app design and development for iOS and Android
Next.jsReactRaspberry PiSwiftKotlin
> coffee.refill() — resuming
[ 03 ] // Services
I can help with websites, automation, AI integration, mobile apps, pentesting, and Unity projects.
Websites & Landing Pages
Modern, fast, mobile-friendly sites built with Next.js/React. Three concept demos — a hair salon, a restaurant, and a dental clinic — are live right now.
See the live demosWebsite performance
I make sites fast and keep a measurement log while doing it: every claim is the median of three PageSpeed runs. On a live education platform: mobile 28 → 58, desktop 39 → 88, homepage 14 MB → 2 MB.
Security hardening
Server and site hardening: WAF rules, admin surfaces closed off by IP, email authentication, worker and memory limits, and a backup regime whose restore has actually been rehearsed. Applied on a live client system.
Admin panel development
Panels that surface a business's own data, measure it, and let it be run from one place — desktop (Tauri + Rust) or web (Next.js). One is live as a logbook a client uses daily.
AI chat assistant
Assistants that build a knowledge base out of a site's own content and answer strictly from it. The engine I built for an education platform produced 116 chunks from 86 sources; on eight Turkish test questions it found the right page eight times out of eight.
Automation & Bots
Telegram bots, Gmail/e-mail automation, and data pipelines in Python and Node.js. My own job-tracking system runs on this 24/7.
AI Integration
Summarization, classification, and assistant features with the Claude and Gemini APIs. My daily AI-news digest bot is a working example.
Smart Home Automation
IoT-based smart home system setup and automation.
Penetration Testing
Vulnerability analysis and penetration testing for systems and network security.
Game Programming
Unity-based game development and gameplay mechanics design.
Mobile App Design
UX-focused mobile app design and development for iOS/Android.
Desktop & Mobile App Development
End-to-end software development for desktop and mobile platforms.
[ 04 ] // Experience
Three short internships showed me different layers — offensive/defensive security, enterprise integration, first-line support — and then I brought them together on my first paying client's live system. Now I'm looking for a full-time team role to do the same in production.
August 2026 – present
Freelance Developer / Technical Consultant
Optimist Akademi · freelance
First paying corporate client: speed, infrastructure and security of a live online education platform. Mobile PageSpeed 28 → 58, desktop 39 → 88 (each figure the median of three runs); homepage ~14 MB → ~2 MB; three sites migrated from an end-of-life server to the cloud; admin surface hardened with an IP allowlist and WAF; email deliverability 5.6 → 8.7. Next up: an AI advisor that builds its knowledge base from the site's own content.
Jul 2025 (20 days)
Cybersecurity Intern
Cyber4 Intelligence
During a twenty-day internship, I used Kali Linux, Nmap, and Metasploit for vulnerability analysis and pentesting. I wrote Python scripts that sped up security tasks and reporting.
Aug 2025 – Sep 2025
SAP PI/PO Intern
Negzel Technology
I examined data flows between enterprise systems in SAP PI/PO and provided technical support for integration tasks.
Jan 2025 – Jun 2025
IT Support
İŞKUR
I provided first-level support for in-house hardware, software, and basic network issues. I handled routine maintenance and troubleshooting.
[ 05 ] // Education
Osmaniye Korkut Ata University
Computer Engineering
Graduation: January 2026
[ 06 ] // Field Dossier
From live products to client work under NDA and on to the open-source archive — one locker, four shelves.
06.1LIVE SYSTEMS
My latest builds, shown with real screens
Three recent products — one commercial (source closed), two open source. Click any screenshot to inspect it up close.
AI Copyright Detection Engine
R&DA 5-layer similarity engine that recognizes a music work from its raw recording, a cover, or even a hummed melody. Built for a copyright collecting society.
- Fingerprint + melodic alignment (Smith-Waterman) + lyrics + notation + stem separation
- Threshold and ANN infrastructure calibrated by measurement to scale to millions of works
- Produces candidates, not verdicts — the final call stays with an expert (honest framing)
PythonDSP / ML5 katmanFastAPI
Commercial · source closed
Intent-Spec Studio
AI PolicyA client-side tool that classifies a raw security/education request against a 4-tier taxonomy and turns it into an in-policy, well-specified prompt. Not an evasion tool.
- Benign / Low / High-Risk / Prohibited classification + hard-stop on prohibited
- 5-element spec builder + a self-audit checklist
- No backend — request data never leaves the browser
React 19TypeScriptViteClient-side
Client-side live demo
All Eye — Terminal Mentor
Dev ToolA local mentor that reads your terminal history and notices the moment you get stuck. It never pastes the answer; it guides in three tiers (nudge → direction → solution).
- Runs locally; secrets are redacted before anything leaves the machine
- Gemini / Groq / Ollama provider fallback chain
- Reliability proven by 528 tests + mutation testing
PythonWindowsGemini APISQLite
The commercial engine's source is never shared — only demo screenshots. The other two projects are public on GitHub.
06.2SEALED SHOWCASE
Two working system examples
Here are two projects covered by NDAs, shown through the features I can share.
In negotiation · NDA
Enterprise digital platform design
A web platform design for a professional institution, with an admin dashboard, interactive maps, a Ctrl+K command palette, theme selection, a mobile app prototype, and AI content analysis.
Stealth project · summary
End-to-end automation systems
A system that automates signal collection, filtering, analysis, demo generation, and notifications using a Telegram bot, scheduled tasks, and multiple notification channels.
Locked ModuleAccess: Admin
micro1 Interview Arena
The private training platform I built for cybersecurity interviews: question banks, a voice-driven AI interview simulator, English practice and company intel.
Peek inside + request access →> visible to everyone; the equipment only runs with an authorized session.
Live demos of these builds can be presented during an interview.
06.3FIELD RECORDS
On the record: delivered work
Client work — names, brands and contents stay sealed for confidentiality. No credits, just outcomes.
> FILE-A: a four-part pitch package prepared for one professional body — demo site, member panel, mobile flow and R&D engine. At pitch stage; the organisation's name, logo and imagery stay sealed.
FILE // RECORD-01NDA
Project name redacted for confidentiality
A scroll-story showcase site with a 3D hero for a creative studio. Brand and content belong to the client — sealed.
Next.jsTypeScriptWebGL / R3FTailwindFramer Motion
2026Delivered
FILE // FILE-A/1SEALED
Project name redacted for confidentiality
A single-page site demo designed from scratch for a professional body with a large membership: three languages, PWA, interactive map, keyboard-driven command palette and music notation rendering. No framework — plain JavaScript, bundled with esbuild.
eslint 0 · vitest 19/19 · Playwright 39/39 · clean build
eslint 0 · vitest 19/19 · Playwright 39/39 · clean build
eslint 0 · vitest 19/19 · Playwright 39/39 · clean build
Vanilla JSesbuildGSAPd3-geoVexFlowPWA
2026Demo · pitch stage
FILE // FILE-A/2SEALED
Project name redacted for confidentiality
A panel concept that brings the member portal, until then living on a separate address, inside the site: a members-only gate, application and report flows, theme choice, accessible focus-trapped modals.
Documented in the pitch deck with 17 screenshots and a flow diagram
Documented in the pitch deck with 17 screenshots and a flow diagram
Documented in the pitch deck with 17 screenshots and a flow diagram
Vanilla JSAccessibilityi18n (TR/EN/RU)Command palette
2026Demo · pitch stage
FILE // FILE-A/3SEALED
Project name redacted for confidentiality
A mobile prototype separating the public side from the member side: location-based lookup, a two-tier rewarded reporting flow and a members-only rights tool. All seven steps are clickable.
14 mockup screens · 7-step flow clickable end to end
14 mockup screens · 7-step flow clickable end to end
14 mockup screens · 7-step flow clickable end to end
HTML/CSS/JS prototypeMobile flow design
2026Demo · pitch stage
FILE // FILE-A/4SEALED
Project name redacted for confidentiality
The R&D leg of the package: an engine that measures, across five layers, whether a new recording resembles a work already in the repertoire. It produces candidates, not verdicts; its screens are in the “Live Systems” chapter.
1,808 works · 216,057,476 hashes · 0.015% false alarms over 20,000 unrelated pairs · pytest 82/82
1,808 works · 216,057,476 hashes · 0.015% false alarms over 20,000 unrelated pairs · pytest 82/82
1,808 works · 216,057,476 hashes · 0.015% false alarms over 20,000 unrelated pairs · pytest 82/82
PythonFastAPIlibrosahnswlib / faissDemucsSQLite
2026Demo · pitch stage
> note: names and contents in these records are masked under NDA/privacy. Details only in an interview.
CLEARANCE LEVEL: 0/306.4OPEN ARCHIVE
Things I've worked on
From game development to automation, from AI to system tooling.
01 / FEATURED
Daily AI Researcher
A Windows tray app that wakes up every morning, reads GitHub Trending and 20+ tech news sources, and uses the Claude API to write a bilingual HTML morning briefing — with dedup memory to keep token costs flat.
PythonClaude APIAutomation
D
Daily AI Researcher
bot
📮 Daily AI Researcher — Sunday, July 12, 2026 / Good morning, Maksut! ☕07:00
🔥 Today on GitHub: malisper/pgrust ↗ +774 stars — a Rust rewrite of Postgres, now at 2,196 stars.07:00
vercel/next.js ↗ +334 stars — the ecosystem leader with 140,998 stars.07:00
The briefing is ready every morning at 07:00.07:00
Emotion Detection Using AI
A real-time facial emotion recognition system built with a Convolutional Neural Network (CNN).
AICNNComputer Vision
2.5D RPG (Unity)
A Unity-based 2.5D RPG game project built in C#.
UnityC#Game Dev
Udemy Career Tracker
A Chrome extension that reads Udemy course progress and a companion web dashboard that turns it into a visual, gamified career-skill tree.
Chrome ExtensionJavaScriptSVG
Gmail Summary Agent
A personal agent that pulls in the day's Gmail, auto-categorizes and drafts replies, and delivers a daily summary with desktop notifications.
Node.jsGmail APIAutomation
Image Cleaner
A Python tool that automatically converts .jpg files in a watched folder to .png and cleans up unwanted files.
PythonAutomation
File Name Logger
A Python tool that exports file names and extensions from a folder into a .txt file.
PythonCLI
[ 07 ] // Work With Me
For a web, automation, or security project, message me on the platform that suits you. We'll define what you need, then get to work.
Note: I'm primarily looking for a full-time team role — this section is for short/independent project requests.
@muhammedmaksut
Freelancer
Flexible collaboration for web, automation, and security projects.
Visit profileGot a project in mind?
My gigs are live on Bionluk — or message me directly on WhatsApp and I'll get back to you the same day.
[ 08 ] // What's Next?
The Udemy cybersecurity course is finished. Next up: TryHackMe labs and the eJPT exam.
Udemy Cybersecurity Course
Completed — cybersecurity fundamentals done
TryHackMe Jr Penetration Tester Path
Hands-on penetration testing practice
eJPT Certification
Prepare for the exam and earn the certification
> console.log("day shipped")
[ 09 ] // Contact
Got a project, job opportunity, or problem to solve? Send a message. Hello works too.