Zero Trust Security
Assumptions are the mother of all mistakes. I design systems that verify everything, trust nothing, and minimize attack surfaces.
RAFET ABBASLI
Offensive Security Researcher & Senior Software Engineer
View my Resume
0 FPS
Who is RVFET?
Everything you need to know about me.
(Double-click to see a TLDR;)I am a Senior Security Engineer and Distributed Systems Developer focused on offensive security research, high-throughput data pipelines, and adversarial automation.
I hold a Bachelor's degree in Information Technologies and an accredited Master's degree in Management Information Systems, both verified with H+ status in the German Anabin database. I also hold an active IELTS Academic C1 Certificate (Score of 7.5).
Over the past 6+ years of hands-on engineering, I have architected distributed threat monitoring infrastructures, high-load Go and Python pipelines normalizing terabytes of unstructured infostealer data monthly, and custom headless browser orchestration engines built directly on the Chrome DevTools Protocol (CDP). My work included niches like patching internal Chromium runtime heuristics to bypass modern anti-bot protections (Cloudflare Turnstile, reCAPTCHA v2/v3) for threat-actor infrastructure tracking.
Alongside engineering, I conduct authorized vulnerability research. My public disclosures include notable figures like Google (Google VRP), LinkedIn, Linear, and national critical infrastructure, some of which is documented on the Write-ups page. Sensitive engagements and critical infrastructure findings remain under non-disclosure. I'm happy to share what I can during an interview, with sanitized proof of concepts, utilized techniques and methodologies.
I'm Open to full-time relocation to the DACH region, and the Netherlands. I'm available to start immediately and eligible for streamlined EU Blue Card and the Dutch Highly Skilled Migrant (Kennismigrant) visas.
Blogs & Research Articles & Write-ups
I publish detailed write-ups on my latest security research findings after full remediation & responsible disclosure.
3s
Philosophy behind my work
Principles that guide my approach to security research and software engineering.
Complexity Reduction
Complexity is where vulnerabilities hide. I fight bloat to keep systems auditable, maintainable, and inherently secure.
Automation First
Human labor is error-prone. I automate repetitive tasks to ensure consistency, reduce mistakes, and free up time for creative problem-solving.
Evidence-Based Decisions
Heuristics is exploitable. I trust logs, metrics, and Proof-of-Concepts (PoCs) over gut feelings to guide my architectural and security choices.
Performance is not Optional
Whether I design for millions of users or a niche audience, I prioritize speed and efficiency to deliver seamless experiences.
Modular Architecture
Monoliths get messy. I build systems with interchangeable components to enhance flexibility, scalability, and ease of maintenance.
Summary of my technical skills
A quick overview of the tools, technologies, and methodologies I employ regularly.
ENGINEERING
SECURITY
TOOLS
Coded for 1900 hours & 10 minutes since 2023
I'm a polyglot developer. Here's a breakdown of the top programming languages I've used this year.
| Language | Time spent | Percentage |
|---|---|---|
| | 982 hrs 57 mins | 51.7% |
| | 209 hrs 2 mins | 11.0% |
| | 177 hrs | 9.3% |
| | 113 hrs 58 mins | 6.0% |
| | 75 hrs 12 mins | 4.0% |
| | 62 hrs 21 mins | 3.3% |
| | 59 hrs 29 mins | 3.1% |
| | 54 hrs 31 mins | 2.9% |
| | 23 hrs 56 mins | 1.3% |
| | 20 hrs 30 mins | 1.1% |
| 68 entries in total | ||
Data provided by Wakatime view more
Socials & Contacts
Feel free to reach out for collaborations, questions, or just to say hi!
Email
Checked regularly, feel free to reach out for any reason.
Telegram
Main communication method. This is where I'm most active and responsive.
LinkedIn
Professional network and career development platform.
GitHub
My GitHub profile. Almost all personal projects are private due to sensitive nature of work.
BugCrowd
I'm not really a bug bounty hunter, but I do report vulnerabilities I find worthy.
Instagram
I rarely use it, a photo a year maybe? I'm only on it when there's a new exploit for it.
ORCID
My ORCID profile, where you can find my academic publications.
Spotify
Ex musician. No longer making music, but old releases are still up.
Everywhere Else
I hold the handle @rvfet on most of the internet. Feel free to search for it to find me.