Known online as<Axo Solaman />
Independent security researcher, software builder, and philosophy student at Dhaka Central University, based in Bangladesh. I engineer open-source developer tools, build autonomous AI agents, and research web vulnerabilities across global security programs.
Type help to view available commands.
Technical breakdowns of vulnerability research methodologies, reproduced protocols, and defensive mitigations.
Target: Coinbase Security Research • Security research analyzing OAuth2 redirect verification and state token validation across multi-service authentication gateways.
During authentication flows, the gateway issued authorization codes without cryptographically tying the state parameter to the user's active session TLS fingerprint.
OAuth2 state tokens must be cryptographically signed, single-use, and session-bound.
GET /oauth/authorize?response_type=code &client_id=cb_auth_gateway_v2 &redirect_uri=https://auth.coinbase.com/callback &state=eyJhbGciOiJIUzI1NiJ9.eyJzZXNzaW9uIjoiYWJjIn0 Host: auth.coinbase.com User-Agent: Mozilla/5.0 (Research/Ethical)
Instant Multi-Account Token Switcher & Zero-Knowledge Vault for Google Antigravity & LLM Quota Stacking.
npx github:axosecurity/antigravity-auth-vault
Stop Wasting Tokens. Ship Production-Grade Features on the First Try with Community-Built AI Skills.
Autonomous Full-Cycle React Native + Expo Subagent with Persistent Project Memory.
npx github:axosecurity/mobile-dev-agent
Definitive Zero-Server-Bandwidth Direct-to-Cloud Upload Engine for Next.js & React.
npm install @axosolaman/secure-next-uploadTechnologies, frameworks, and environments utilized across web application security assessments, systems engineering, and software development.
Web App, API, Mobile (Android), Network, WebSocket & MCP Server security testing, Linux pentesting, OWASP Top 10, and bug bounty.
Full-stack edge architectures on Cloudflare (Workers, Pages, D1, KV), Next.js, OpenNext.js, React Native, Hono.js, Express.js, and TypeScript.
AWS & Azure cloud security, Kubernetes (K8s) & cluster security hardening, Cloudflare edge infra, Linux administration, and Docker.
Autonomous AI agent architecture, Model Context Protocol (MCP) servers, LangGraph orchestration, Cloudflare Workflows, and n8n automation.
An architectural examination into chaining three low-severity misconfigurations into full pre-authentication account takeover without victim interaction.
Comprehensive testing methodologies and bypass scenarios in modern distributed reverse-proxy architectures.
A philosophical exploration into the hidden internal heat, discipline, and endurance behind public achievement.
Advocating for a regional future built on open education, scientific inquiry, mutual dignity, and the defense of human freedom.
Open to conversations with fellow security researchers, open-source engineers, and collaborators focused on youth literacy and social impact.