LAYER 00 · BASE

HIMEL AHMED

Full-stack developer who builds the product and then tries to break it.

Dhaka, Bangladesh — available remote.

Email meDownload CV
Receipts, not claims
Every project below has a case study; every finding has a writeup. Nothing on this page asks to be taken on trust.
WHILE YOU'RE HERE

Beat the bot.

It plays perfectly, so a draw is the best result that exists. Find a win and you’ve found a bug — email me, I’ll want the repro.

FIRST MOVE
THINKING…
WINS 0  ·  DRAWS 0  ·  LOSSES 0
SELECTED WORK / 03
A selection of projects I’ve worked on, including personal work, client work, and collaborations.
Toolify3D quote screen

Toolify3D

TOOLIFY3D.COM

Upload an STL, get a price. No human in the loop.

Solo build — customer client, admin dashboard and API deployed as three services.

REACTNODEEXPRESSMONGODBLIVE
MediGo matching screen

MediGo

DEMO ON REQUEST

Real-time patient-to-doctor matching. 2nd of 135.

Three-person team — I built the Socket.io request layer and the location matching.

REACTSOCKET.IOSUPABASEOPENSTREETMAPSHIPPED
Cyber-Cell triage dashboard

NBA Cyber-Cell

CYBER-CELL-NBA

Harassment reports, triaged and tracked. National rollout.

Lead developer — reporter submission form feeding an admin triage queue with recorded actions.

MONGODBEXPRESSREACTNODEIN DEVELOPMENT
COMPETITION RECORD
1st / 140Phoenix Summit CTF 2025national
1st / 50IUT CTF 2024Islamic University of Technology
2nd / 135Asset Skill Competition 2025 — MediGonational innovation
finalist8th DIU Final CTF · BUET CTF · Cyber Raid (MIST) · Flag Fest CTFinter-university
4 podium finishes · 2 national titles · 325 teams beaten
DISCLOSURE + WRITEUPS
ACKNOWLEDGED2025

DW News — email verification bypass

The account registration API returned the one-time passcode in its response body. Any email address could be registered without owning it.

Reported 2025; acknowledged by the vendor. No bounty programme was running at the time.

STACK
LANGUAGES
JAVASCRIPT ES6+TYPESCRIPTHTML5CSS3
FRONTEND
REACT 19NEXT.JS 16REACT ROUTERTAILWINDSHADCN UIHEROUIFRAMER MOTIONRECHARTS
BACKEND + DATA
NODE.JSEXPRESSREST API DESIGNJWT + JWKSMONGODB
SECURITY
OWASP TOP 10PENETRATION TESTINGBURP SUITENMAPWIRESHARK
TOOLS + DEPLOYMENT
GITVERCELNETLIFYPOSTMANLINUXFIGMAWORDPRESSOPENSTREETMAP
EXPERIENCE

Independent full-stack developer

2026 — PRESENT

Ship full-stack applications end to end across Next.js, Express and MongoDB. Most recently MediGo and Sportnest.

Project manager — DYBWEB

JUL 2025 — MAR 2026

Delivered 2 client web and e-commerce builds (React, Node, MongoDB, Stripe) with a 4-person team. Every scheduled deadline met.

Independent security researcher

2024 — 2025

Vulnerability assessment and web application penetration testing. Hardened WordPress and custom deployments against the OWASP Top 10.

Diploma, Computer Science & Technology

2023 — 2027

Munshiganj Polytechnic Institute, Bangladesh.

CERTIFICATIONS
  • EC-Council Essentials — Network Defense (NDE), Ethical Hacking (EHE)
  • Google Cybersecurity Certificate — 4 courses (Coursera)
  • Programming Hero — Web Development L1, L2 in progress
  • Purple Teaming Fundamentals — CyberWarFare Labs
Portrait of Himel Ahmed
DHAKA, BANGLADESH · GMT+6
OPERATOR
I'm a full-stack developer in Dhaka. I build the product, then I try to break it. That second habit is how I found a verification code sitting in a registration response, where anyone watching could read it.
I'm vice president of the MUPI Computer Club, which has over 550 members. I have run CTF and security training for 70+ students across three sessions, and an inter-polytechnic TechFest that drew over 200 people. At NBA Cyber-Cell I'm lead developer on the harassment reporting platform, and I speak to college groups about digital safety — 130+ students so far.
What I want next is a full-stack role where security review is part of shipping, not another team's ticket. I'm partway through a diploma in Computer Science, though most of what I know came from building things and then testing them. I shoot nature and macro when I'm not at a keyboard.
550+
MUPI CLUB MEMBERS LED
200+
TECHFEST ATTENDEES
130+
STUDENTS TAUGHT
CONTACT · PRINT COMPLETE

Open to full-stack roles — remote or relocation.

Also taking freelance builds. Email goes straight to me — no form, nothing to lose your message.
HIMEL AHMED · DHAKA, BANGLADESH+880 1648876759Photography07 LAYERS · Z 1.00 · PRINT COMPLETE