Skip to content
arafat@ops:~/dashboard

$ whoami --production-context # my name / my receipts

I earned the ego.
Here's the paperwork.

I'm Easin Arafat, Application Security Engineer at Startise, working on xCloud. I build AI tooling and turn research, QA, documentation and operations into review-gated automation through AIFlowiz. If it cannot survive production, it does not get to impress me.

Nine disclosed CVEs. An Elsevier Q1 paper. My confidence has references.

See what I built$ ls ~/projectsSee what I found$ ls ~/security-research
Easin Arafat, Application Security Engineer at Startise working on xCloud, AI tooling and review-gated automation.
Easin Arafat working at a laptop beside a terminal display
My day job
Application Security Engineer
Where I work
xCloud at Startise
What has my attention
AI tooling, review-gated automation and systems that survive production
What I insist on
Evidence and approval before impact

$ ls ~/about/context

my work / security / platforms / AI

I have range.

  • I question the permissions.

    I trace attack paths, test authorization boundaries and make the findings reproducible. A reassuring checkbox is not evidence.

    9 Patchstack records

  • I stay for production.

    I work on release paths, reliability and recovery. The launch is the part where the system starts answering back.

    xCloud at Startise

  • I give AI a job description.

    I build execution harnesses, policy gates and shared context. Generating an answer is the easy part; I want work I can inspect.

    Yoke, Herdr setup and agent tools

$ ls ~/about/process

my review comes before release

I don't ship on vibes.

I set the outcome, bound the work and keep the evidence visible. I like a clever solution. I still make it pass review.

[SECURITY / I CHECK THE BOUNDARY]

I make assumptions uncomfortable.

Input / Application behavior, identities, permissions, and exposed attack surface.

What I do
Threat modeling, authorization review, vulnerability research, and reproducible security verification.
What I leave you with
Clear risk context, remediation paths, and public research across access control and sensitive-data failures.

[PLATFORM / I KEEP THE CONTEXT]

I expect production to have opinions.

Input / Infrastructure changes, deployment procedures, server symptoms, and operational handoffs.

What I do
Build deployment and recovery paths with logs, health checks, visible failure modes, and practical documentation.
What I leave you with
Repeatable operations that make diagnosis and recovery less dependent on one person remembering the steps.

[AI / I CHECK THE WORK]

I read the work before the victory speech.

Input / Coding agents, engineering workflows, project knowledge and execution boundaries.

What I do
Build harnesses, shared context, policy gates, independent review and resumable execution around coding agents.
What I leave you with
Agent work that can be inspected, reviewed and continued, with the human decision-maker in control.

$ ls ~/about/proof

my disclosures / my research / my code

I put it on the record.

$ ls ~/about/trajectory

my career / apparently one discipline wasn't enough

I kept adding responsibilities.

I started with products, followed the security questions and took on platform operations. I want systems that survive production. Apparently that requires knowing more than one thing.

  1. I build.

    Full-stack projects taught me what the product actually needs.

  2. I investigate.

    Offensive security and disclosure work taught me where confidence needs evidence.

  3. I keep it running.

    Platform reliability and AI workflows made the delivery system part of what I build.

$ safeguards --always-on

I have standards.
They apply to my work.

  • I start with a boundary. Establish one useful outcome, its failure modes, and the evidence needed to trust it before expanding scope.

  • I keep access on a short leash. Give people, services, and AI workflows only the access that the current task actually requires.

  • I approve before it matters. External, destructive, or difficult-to-reverse actions stay behind an explicit human decision.

  • I bring the evidence. A result includes test evidence, operational context, and known limits, not only a claim that it works.

$ ls ~/about/next

my inbox / your interesting problem

I like a difficult brief.

Show me the system, the constraints and what success needs to look like. I work across application security, platforms and AI tooling. Give me something worth thinking about.

Open a channel$ ./connect.sh --secureExplore AIFlowizAIFlowiz / review-gated automation