Security engineer · Google VRP–credited · Founder, Cindrasec
_{Attack-surface & AI/LLM security — Dhaka, Bangladesh · working globally}
🌐 Cindrasec • 📧 Email • 🔗 LinkedIn • 📄 Résumé

Finds credentials that were shipped to production by accident, and proves they are real before anyone is alarmed. Spider → 63 detection patterns → entropy filtering → two-tier AI validation → alerting, with a live dashboard and SARIF / HTML / CSV / JSON reporting.

The design constraint that shapes everything: it is passive. SecretNode never uses a discovered credential to demonstrate that it works, and never writes to a target. Verification stops the moment validity is established.

Python · FastAPI · SQLite · CI on 3.11/3.12 · 382 tests · Docker · v2.8.0

Continuous attack-surface and AI/LLM security monitoring for founders and small teams — the people who cannot afford an enterprise security budget but equally cannot afford a breach. Built and run from Bangladesh, serving clients locally and globally, in Bengali and English.

No scan begins without a signed Rules of Engagement. That is a hard rule, not a formality.

A measured, reproducible study of prompt-injection resistance in a small local model (Llama 3.2 3B, via garak, 256 trials per attack). The same model was hijacked 46.9% of the time by one payload and only 10.2% by another — a 4.6× content-dependent gap whose 95% confidence intervals do not overlap.

The lesson generalises past the model tested: injection resistance is a distribution, not a number. Benchmark one payload and your published figure can be off by multiples from the threat you actually face. Includes full reproduction on a Raspberry Pi, and honest limitations — including a third probe that stalled and why it was excluded rather than quietly dropped.

A total authentication bypass on a Google-acquisition asset — default credentials, any password accepted, and an unauthenticated backend API behind it. Triaged P2/S2, fixed in 9 days, awarded credit rather than cash.

The writeup does the harder thing: it explains at a mechanism level why "fixed fast" and "not rewarded" were both correct. The root cause was a stale DNS record on un-migrated acquisition infrastructure — reachable through Google's edge but never operated by Google. That edge-fronted ≠ operated distinction is the transferable part.

Both writeups are published in 9 languages.

I came to security sideways. Five years of my career were spent in emergency and humanitarian medicine — ICU and ER wards, and the Médecins Sans Frontières response in the Cox's Bazar refugee camps — before they were spent on infrastructure.

That turns out to transfer better than it sounds. Triage is triage: you are always deciding what is actually urgent while incomplete information arrives faster than you can process it, and the cost of crying wolf is that nobody moves when it matters. It is also where I learned to write findings the way I write them now — calibrated honestly, even when a lower severity is the less impressive answer. The Google VRP finding above is credit-only precisely because I rated it accurately rather than optimistically.

• 🔍 Verification-first — a finding is confirmed before it reaches you, so you get signal instead of a queue of maybes
• ⚖️ Calibrated severity — accurate CWE/CVSS framing, including when that means arguing a finding down
• 🤝 Authorized only — passive-first, rate-limited, in-scope, under signed authorization
• 🌐 Bilingual delivery — Bengali · English (plus working Rohingya/Chittagonian from the camps)

Full details on the résumé.

• 🏅 Google Cybersecurity Professional Certificate — Coursera, Jan 2025 · Verify
• 🏅 TryHackMe — Advent of Cyber 2024 — Dec 2024 · Certificate
• 🏅 Mastercard Cybersecurity Job Simulation — Forage, May 2024 · Certificate
• 🎓 BSc in Nursing — University of Rajshahi (2013 – 2017) · Registered, Bangladesh Nursing & Midwifery Council

Security engagements — attack-surface monitoring, exposed-credential assessment, and AI/LLM security testing — go through cindrasec.com. The first Snapshot is free.

Roles — I'm also open to positions in security engineering, SOC analysis, threat detection, cloud security, and GRC.

📧 azmolhaque95@gmail.com · 💼 LinkedIn · 📄 Résumé (PDF)

Built for impact, triage, and trust.