Security-focused open-source contributor and bug fixer. I harden the unglamorous parts of real codebases — credential handling, auth flows, input validation, and the correctness bugs that only bite in production — and research CI/CD and supply-chain risk.
- Credential & auth hardening: file locking, ACL tightening, secret-file guards
- API/CLI correctness: retry safety, response validation, typed error handling
- GitHub Actions, OIDC, workflow permissions, and supply-chain risk
- Clear reports with impact, reproduction steps, and practical fixes
15 merged pull requests across production open-source projects:
- TestSprite CLI — 10 merged PRs; recognized in the Season 3 CLI Improvement Track. Locked credential-profile mutations against cross-process races, tightened Windows credential ACLs, stopped non-idempotent request retries, rejected malformed API keys before dispatch, and guarded secret-file reads behind typed validation errors.
- memanto (moorcheh-ai) — guarded MCP batch operations against malformed results; fixed noisy LLM JSON extraction.
- TrusTrove (Soroban / Rust) — hardened a pool utilization overflow in a smart contract.
- Loru and NokaMan (mergeos-bounties) — closed test-coverage gaps in a sign-language training toolkit and a CEFR writing-assessment pipeline.
Tech: TypeScript / Node.js · Python · Rust (Soroban) · Bash
- GitHub Actions OIDC research labs:
- Bug fixing and security research notes:
- Reproduce first, report second
- Keep fixes minimal and reviewable
- Show exploitability with controlled proof of concept
- Prefer clear evidence over broad claims
Open to freelance & contract work — security review, hardening passes, and OSS contributions. Reach me at naufalfx805@gmail.com, or open an issue for bug reports and research collaboration.