System Architect · Security Researcher · Photographer
Morteza
Bahmani
Independent creator exploring the intersection of security, infrastructure, and digital craft. Building at Internet Labs.
Blog
Recent writings on security, infrastructure, and the open web
whoisthat: A Rust TUI VPN Client Backed by a Go/Xray Engine
whoisthat splits a VPN client into two processes: a Rust TUI for the terminal interface and a Go engine driving Xray-cor…
Agent Execution Traces: Making the Unthinkable Visible
Sandboxing agents stops working once they can reason at runtime. Instrumentation through execution traces is the real pr…
Deterministic First, LLM Second: Rebuilding Automated Code Review
Why pure agentic code review creates PR noise, and how pairing deterministic static analysis with targeted language mode…
Merkle-Damgard State Leakage: Exploiting Secret Concatenation in API Auth
How Merkle-Damgard hash constructions leak internal state vectors and why secret concatenation fails API authentication.
Shizuku: How Android Apps Access System APIs Without Root
Android's permission model gates system APIs hard. Shizuku brokers privilege access without root, letting apps query sys…
Interview: Replacing Mermaid Slop with Semantic SVG Architecture Diagrams
Cathryn Lavery explains why automated graph renderers fail in production documentation, how strict density budgets elimi…
Older Posts
Movie Diaries
from Letterboxd Letterboxd
Projects
01 / 04Things I'm building and contributing to
