Security Engineer & Full-stack Developer from Sarajevo, Bosnia and Herzegovina.
I build software, research security vulnerabilities, and improve how applications are developed and secured. I've been building production software since 2018 and today work as SecOps Lead at Circeus, doing source-code security audits, penetration testing and application security reviews.
Outside work I build open-source tools, experiment with programming languages, and explore AI-driven development.
Available for selected consulting engagements and open-source collaboration.
🌐 pr0h0.me · 💼 LinkedIn · ✉️ Contact · 📄 CV
| Project | What it is |
|---|---|
| BPL3 | A statically typed, compiled programming language targeting LLVM — native compilation, generics, a package manager, formatter and VS Code extension. |
| OpenManga | Self-hosted studio that turns a story into a consistent AI-illustrated comic, webtoon or narrated video. Bring your own keys, no telemetry. |
| DevDrop | Developer-aware workspace sync across machines, servers and AI agents, with chunked delta sync and end-to-end integrity checks. |
| CodeGuardian | Docker-first local security auditing CLI combining established scanners, optional AI triage and Markdown / JSON / SARIF reports. |
| ServeBox | A local file browser and server with a Finder-style web UI, previews and strict root-directory confinement. |
| Vaktija for macOS | Native menu bar app and desktop widgets for Sarajevo prayer times. |
| DarkNet | A Hacknet-inspired hacker-OS adventure game that runs in the browser. |
More — including private and commercial work — on pr0h0.me/projects.
- OSWA — OffSec Web Assessor (2024)
- OSWE — OffSec Web Expert (2025)
Public advisories (Tolgee Platform, credited as reporter):
- GHSA-535f-x3hw-p4p8 — Broken object-level authorization across organization and project resources
- GHSA-4mw7-vff5-96jj — Slack bot-event signature verification bypass