I make "done" prove it.
Yoke
Local policy gates for Claude Code and Codex: human-approved checks, independent review and a console that shows the decision trail. A pre-release tool built around proof of completion.
Easin ArafatApplication Security Engineer at Startise
Current focus agentic AI systemsSmart is common. Smart and secure is rare.
That's the part I do.
I'm an Application Security Engineer at Startise. I run AI coding agents in parallel, design the review gates that keep them honest, and break my own systems before anyone else gets the chance. 40+ projects shipped while others were still choosing a tool.
The operator behind the fleet.

Security sets the guardrails.
The fleet carries the work.
$ ls ~/work
my answer to repetitive workI want context that sticks, sessions that survive, and changes I can inspect.
So I built the tools.
I take security personally.Check my findings
I make "done" prove it.
Local policy gates for Claude Code and Codex: human-approved checks, independent review and a console that shows the decision trail. A pre-release tool built around proof of completion.
I gave multitasking a floor plan.
One-command setup for running Claude Code, Codex and Agy side by side in herdr. The fleet command starts workers, gives them tasks and keeps their work visible; an interactive manual lets you plan the layout first.
I gave my books a plus-one.
A private reading library with an AI tutor beside the passage: word meanings, explanations, offline natural voices, precise bookmarks and shared libraries. Readers bring their own Claude Code, Codex or API key.
I insist on a second opinion.
A Claude Code skill for supervised app-building loops. Isolated planning, generation, deterministic gates and adversarial evaluation exchange evidence through files, so the builder does not grade its own work.
I keep the whole team in view.
A coordination framework for agent teams, Kanban tasks, inter-agent messaging and multi-stage workflows, with shared memory and a signed audit trail. A dashboard keeps team activity and workflow execution in view.
I can see what ran.
A folder-scoped terminal agent where shell commands and natural-language requests share one prompt. Tool calls, file changes and approval steps stay visible, with hosted models, local Ollama or a Claude Code CLI connection.
I gave parallel work its own space.
A shell-native Git worktree manager for listing, creating and moving between workspaces by number or name. It keeps parallel agent work in separate directories without making the operator memorize paths.
I turned repetition into a skill.
A personal toolkit of reusable Claude Code skills, including article and security-research workflows. Structured instructions and supporting templates turn repeated work into a repeatable process.
A closer look at my work
I built TermStream for persistent coding sessions and Second Brain.Deck for connected knowledge. Here is what I wanted, what I built, and why.
A secure browser and mobile control plane for persistent AI coding sessions on infrastructure the user owns.
Explore TermStream Open ts.arafatops.com
A browser control deck for an interconnected Markdown vault, built to keep useful knowledge close to the moment it matters.
Explore Second Brain.Deck Open obsidian.arafatops.com
$ ls ~/proof
my claims have linksI disclose responsibly / Patchstack
I found broken access control, IDOR, and data exposure in WordPress plugins. I bring that same suspicion to every system I build.
cd security-research ->I CO-AUTHORED / ELSEVIER ARRAY
DOI: 10.1016/j.array.2026.100901
cd featured ->$ ls ~/write
my brain, in public17 Medium articles. I write about AI, security, business, psychology, and whatever else refuses to leave my head.
My latest Medium essay
I have interests outside work.Why romance cannot carry an entire life, and how friendships, personal interests and a sense of agency create something worth sharing with another person.
Read on Medium$ ls ~/etc
I leave the keyboard, too2021:
My team won URC 2021.
I led software and communication for MIST Mongol Barota at the University Rover Challenge.
I build communities, read, compete, and occasionally remember the world has an outside.
Leadership
President of MIST Cyber Security Club (2023-2024)
MIST LEETCON 2023
Event Organizer for Bangladesh's first international cybersecurity conference, hosting 3,500+ participants.
CTF Competitions
CTF Player and Problem Solver. Ranked top 1% in TryHackMe.
Flaghunt 2023
Event Host for National CTF Competition in collaboration with CTFBD.
Cyber Drill 2023
Organizer for Financial Institute & Critical Information Infrastructures Cyber Drill.
Cyber Threats Seminar
Host for emerging cyber threats seminar with Armed Forces Division of Bangladesh.
Sports
Active participant in sports like Football, Cricket, Kickboxing, Swimming, Table Tennis, Badminton, etc.
Hobbies
Love Reading, Writing, and Travelling.
$ ls ~/skills
my skills need their own orbit78 skill modules. 9 domains. I gave them a universe.
Launch pad ready.
cd skills ->4 sides of me connected.
I have receipts for that.
I find broken access control, IDOR and data exposure. I disclose responsibly through Patchstack.
cd security-research ->I have shipped 40+ projects. I prefer my ideas running in production.
cd projects ->I write about business because code is only part of what makes the world work.
cd business ->I build security tools, DevSecOps automation and web apps I actually want to use.
cd projects ->$ ./connect.sh --secure
Give me a stubborn security problem, a tool that should exist, or an idea with some nerve. I like having something to prove.
TALK TO ME$ ./connect.sh --secure