Hi, I'm Arshad.
I ship, hunt & write code.
I run a tiny SaaS suite under i*.today, hunt bugs as @codermak, and write software at Smartly.io. I do all three because I haven't figured out which one I love more.
Catch leaked secrets across GitHub, GitLab, NPM, Docker Hub and more. Built for bug bounty hunters.
Real-time GitHub leak monitor. Pings me the moment a token is published in public.
SSL expiry + subdomain takeover alerts on autopilot, straight into Slack and Discord.
E2E-encrypted self-destruct links. The Privnote replacement I actually trust to read my own code.
Chrome extension that gives your AI CLI a seat in every GitHub PR — reviews, diagrams, chat.
Auto-detects and blocks AI reply-farming bots on X/Twitter, entirely in your browser.
Paste any GitHub access token and instantly see exactly what it unlocks.
Tiny PyPI lib: ISO currency codes → symbols.
Twitter bot tweeting good-first-issues for new OSS contributors.
Personal collection of CLI shortcuts I use every day.
An AI pentest agent that lives inside Claude Code.
Local-only secret scanner for any GitHub org's repos.
Save command chains under a single shortcut name.
Claude Code-style agent powered by the Deepseek API.
Toggle git remote between HTTPS and SSH instantly.
Analyze leaked API tokens; figure out what each one unlocks.
Catch leaked secrets across GitHub, GitLab, NPM, Docker Hub and more. Built for bug bounty hunters.
Real-time GitHub leak monitor. Pings me the moment a token is published in public.
SSL expiry + subdomain takeover alerts on autopilot, straight into Slack and Discord.
E2E-encrypted self-destruct links. The Privnote replacement I actually trust to read my own code.
Chrome extension that gives your AI CLI a seat in every GitHub PR — reviews, diagrams, chat.
Auto-detects and blocks AI reply-farming bots on X/Twitter, entirely in your browser.
Paste any GitHub access token and instantly see exactly what it unlocks.
Tiny PyPI lib: ISO currency codes → symbols.
Twitter bot tweeting good-first-issues for new OSS contributors.
Personal collection of CLI shortcuts I use every day.
An AI pentest agent that lives inside Claude Code.
Local-only secret scanner for any GitHub org's repos.
Save command chains under a single shortcut name.
Claude Code-style agent powered by the Deepseek API.
Toggle git remote between HTTPS and SSH instantly.
Analyze leaked API tokens; figure out what each one unlocks.
Three things, in parallel.
A snapshot of where my hours go.
Things I've shipped.
All 12 — what's live in production and what's been retired.
Catch leaked secrets across GitHub, GitLab, NPM, Docker Hub and more. Built for bug bounty hunters.
VisitReal-time GitHub leak monitor. Pings me the moment a token is published in public.
VisitSSL expiry + subdomain takeover alerts on autopilot, straight into Slack and Discord.
VisitE2E-encrypted self-destruct links. The Privnote replacement I actually trust to read my own code.
VisitChrome extension that gives your AI CLI a seat in every GitHub PR — reviews, diagrams, chat.
VisitAuto-detects and blocks AI reply-farming bots on X/Twitter, entirely in your browser.
VisitPaste any GitHub access token and instantly see exactly what it unlocks.
VisitHunting as @codermak
Same handle, every platform. Click any card for the live profile — that's where my latest reports, reputation and rankings live (no stale numbers here).
Open source.
A few of the 327 repos I've made public. Most are tiny on purpose.
Tiny PyPI lib: ISO currency codes → symbols.
—/moTwitter bot tweeting good-first-issues for new OSS contributors.
Personal collection of CLI shortcuts I use every day.
An AI pentest agent that lives inside Claude Code.
Local-only secret scanner for any GitHub org's repos.
Save command chains under a single shortcut name.
Claude Code-style agent powered by the Deepseek API.
Toggle git remote between HTTPS and SSH instantly.
Analyze leaked API tokens; figure out what each one unlocks.
Why I build.
I write code for a living, then go home and write more code for fun. It looks unhealthy on paper. It feels like the opposite from the inside.
The day job at Smartly.io is where I get to do serious engineering — big systems, real users, careful trade-offs. The nights and weekends go into the i*.today suite: small, opinionated tools, each born from a problem I had myself. A secret I almost missed. An SSL cert that expired silently. A Privnote link I didn't fully trust.
And then there's the bug bounty side. @codermak is the handle I hunt under, and it's the part of my life that closes the loop: tools I build for hunting end up shipped as products, and bugs I find in the wild surface ideas for tools that don't exist yet.
If you're building something cool, hunting something tricky, or hiring for something interesting — DM me on X or drop an email. I read everything.
— Arshad