Programming Languages
BPL3
A statically typed compiled programming language targeting LLVM, exploring native compilation, modern language features, and developer tooling.
- TypeScript
- Bun
- Clang
- Compilers
- LLVM
- Language design
- Systems programming
Abdulah Proho · Sarajevo, Bosnia and Herzegovina
Security Engineer & Full-stack Developer
I build software and make it more secure. Currently SecOps Lead at Circeus, working across a portfolio of 50+ applications.
Engineering since 2018 · OSWE · OSWA
Selected work
Featured projects
AI / Developer Tools
OpenManga
A self-hosted platform for creating AI-generated manga, manhwa, webtoons, and narrated video content through structured story planning, image generation, character references, narration, and production workflows.
- TypeScript
- Docker
- Kokoro TTS
- AI
- Self-hosted
Now
Currently building
- OpenManga
A self-hosted platform for creating AI-generated manga, manhwa, webtoons, and narrated video content through structured story planning,…
OpenManga v0.17.0
Panel shapes, custom page layouts, and wavy, torn or brush-stroke page and panel edges in the page editor.
pr0h0.me rebuilt
A new portfolio and private CMS: one Go service, server-rendered with templ and htmx, SQLite, and fail-closed publishing.
Career
Experience
SecOps Lead · Circeus
Application security work across a portfolio of more than 50 applications, as part of the company's security and engineering teams.
Senior Full-stack Developer · ShopCircle
Worked on established Shopify applications, building functionality, maintaining existing systems, modernizing legacy code, fixing bugs, and improving performance and security.
Full-stack .NET Developer · Ankeboot
Full-stack software development using .NET technologies.
Security
Research & certifications
OSWA · Offensive Security Web Assessor
Verify credential (opens in a new tab)
OSWE · Offensive Security Web Expert
Verify credential (opens in a new tab)GHSA-535f-x3hw-p4p8 High severity
Broken object-level authorization across organization and project resources
Read advisory (opens in a new tab)GHSA-4mw7-vff5-96jj High severity
Slack bot-event signature verification bypass
Read advisory (opens in a new tab)Writing
Latest articles
HackyJS: running an AI-assisted security blog in the open
What HackyJS covers, how its self-hosted platform and content pipeline work, and why every post discloses how much of it was AI-generated.
Fail-closed publishing: how this portfolio keeps drafts private
Nothing on this site becomes public unless I explicitly publish it. Here is how the publishing model, media handling and tests enforce that by design.
Contact
Let's talk
Available for selected consulting engagements and open-source collaboration.