System Architect · Security Researcher · Photographer
Morteza
Bahmani
Independent creator exploring the intersection of security, infrastructure, and digital craft. Building at Internet Labs.
Blog
Recent writings on security, infrastructure, and the open web
Deterministic First, LLM Second: Rebuilding Automated Code Review
Why pure agentic code review creates PR noise, and how pairing deterministic static analysis with targeted language mode…
Merkle-Damgard State Leakage: Exploiting Secret Concatenation in API Auth
How Merkle-Damgard hash constructions leak internal state vectors and why secret concatenation fails API authentication.
Shizuku: How Android Apps Access System APIs Without Root
Android's permission model gates system APIs hard. Shizuku brokers privilege access without root, letting apps query sys…
Interview: Replacing Mermaid Slop with Semantic SVG Architecture Diagrams
Cathryn Lavery explains why automated graph renderers fail in production documentation, how strict density budgets elimi…
Agentic Reverse Engineering: Bridging Binary Disassembly and Model Context Protocol with REA
An architectural analysis of REA, an open-source MCP server that coordinates disassemblers, dynamic tracing, and static …
Europol Quantum Warning: Hardening Crypto Wallet Signatures Before Harvest-Now Attacks
Europol flagged crypto wallets as the primary risk for harvest-now-decrypt-later quantum attacks. Here is a technical br…
Older Posts
Movie Diaries
from Letterboxd Letterboxd
Projects
01 / 04Things I'm building and contributing to
