Skip to content
View SetraTheXX's full-sized avatar
10 followers · 39 following

Achievements

Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: Pull Sharkx2Achievement: YOLO

Achievements

Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: Pull Sharkx2Achievement: YOLO

Highlights

Block or report SetraTheXX

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
SetraTheXX/README.md

Tuncay Ölmez

Developer Tooling · Application Security · Local-First Systems

I build tools that turn vague engineering risk into evidence you can inspect: deterministic findings, bounded workflows, and read-only diagnostics.

LinkedIn   npm   Email

About me

I am a Computer Programming student at Ondokuz Mayıs University in Samsun, Türkiye. Most of my projects begin as something I want to understand or use, then move beyond the demo stage through tests, documentation, CI, explicit limitations, and reproducible verification.

AI-assisted tools are part of my planning and implementation workflow, but they do not get the final say. Runtime behavior, automated checks, manual review, and honest evidence remain the release gates.

Featured projects

next-secure-check

A deterministic, Next.js-focused security sanity check for pre-deploy review and CI. It finds common risk patterns and explains why they were flagged, without executing the scanned repository or using an LLM at runtime.

Current: v0.6.0 on npm · 25 rules · 600 tests
Use it: npx one-off scans · compact --summary output · SARIF · Action v1.2.0 via @v1
Proof: GitHub CI green · secure fixture 99/100 · vulnerable fixture 26 findings
TypeScript AST-assisted bounded flow

View repository →

Codex Engineering Workflow Pack

Adds a bounded control plane around Codex: approve the scope, execute in an isolated worktree, verify outside the model loop, require independent review, and leave a portable receipt.

Current: v0.14.0 · npm stable · GitHub stable release
Flow: plan → approve → execute → verify → reviewer PASS → receipt → finalize
Node.js 22+ Codex plugin local MCP

View repository →

PortalDoctor

Explains why Linux screen sharing, file choosers, and screenshots fail by reconstructing XDG portal routing and checking D-Bus, systemd, PipeWire, and WirePlumber. Read-only by design, with no telemetry or runtime AI.

Current: v0.2.1 · crates.io · Linux x86_64 binary
Demo: slow, readable terminal flow · 20 findings
Rust 2024 terminal + JSON + Markdown read-only

View repository →

Pagonic

Inspects ZIP archives for path traversal, suspicious entries, extreme compression ratios, unsupported methods, and structural errors before extraction. Provides deterministic reports and policy gates as a Python library and CLI, installable from PyPI and ready for CI workflows.

Current: v0.5.0 alpha · PyPI · TestPyPI · GitHub release · wheel + sdist
Flow: inspect → verify → safe-extract
Python CLI safe extraction JSON + Markdown

View repository →

Merged open-source contributions

Project Pull request Focus
Ship Safe #161 MCP/OAuth security checks
OWASP Noir #2657 Vercel specification analyzer functional coverage
cargo-deny #893 Sparse registry matching for literal IP hosts
codex-with-chatgpt #26 OAuth pairing-page HTML hardening and browser security headers

More work

Project What it explores Current state
BioVoid A local computational research prototype combining deterministic full-heavy-atom structure preparation, geometry-based pocket-candidate detection, a quality-gated experimental NMA layer, and interactive Mol* inspection. v0.1.0 public source baseline
Nihongo Learn Japanese learning for Turkish-speaking beginners: kana, SM-2 reviews, 31 lessons, mini stories, and N5-style practice. usable local MVP

Scientific boundary: BioVoid is a research prototype. It is not a clinical, diagnostic, validated binding-prediction, or drug-development system.

Toolbox

Core

TypeScript, Python, and Rust

Runtime & application stack

Node.js, Next.js, React, FastAPI, and SQLite

Engineering tooling

GitHub Actions, Docker, and npm

Pinned Loading

  1. next-secure-check next-secure-check Public

    Deterministic security checks for Next.js projects. Run with npx or GitHub Actions and review clear terminal, JSON, Markdown, GitHub Summary, or SARIF output.

    TypeScript 5

  2. Codex-Engineering-Workflow-Pack Codex-Engineering-Workflow-Pack Public

    Local-first engineering workflow toolkit for Codex: skills, Coordinator Mode, worktree isolation, guarded dispatch, and parallel agent workflows.

    JavaScript 1

  3. BioVoid BioVoid Public

    Local computational research prototype for protein structure preparation, geometry-based pocket candidate detection, and reproducible heuristic analysis.

    Python 1

  4. pagonic pagonic Public

    Security-aware ZIP inspection for Python and CI: deterministic reports, policy checks, and safe extraction inspect before you extract.

    Python 1

  5. Portal-Doctor Portal-Doctor Public

    Read-only Linux CLI for diagnosing XDG Desktop Portal, Wayland session, D-Bus and systemd user integration issues.

    Rust 1

  6. nihongo-learn nihongo-learn Public

    Japanese-learning MVP for Turkish-speaking beginners, featuring kana practice, SM-2 reviews, A1 lessons, mini stories, N5 exam practice, and optional Supabase sync.

    TypeScript 3