I'm a Software Engineer from Dhaka, Bangladesh 🇧🇩 with nearly 5 years of shipping production web and mobile products end to end — the API, the front end, the mobile app, and the infrastructure underneath them.
Most of what I build for myself now is in Rust: developer tooling and security tooling that has to be fast, predictable, and safe to leave running. The rest is full-stack TypeScript — NestJS services, Next.js front ends, and React Native apps that all talk to the same API.
I care about clean architecture, thoughtful UX, and code that ages well. I'd rather ship one tool people actually depend on than ten demos, and I'd rather be honest about what's finished than inflate a README.
🔭 Currently building — WP Pond, a native (non-Docker) local WordPress development environment in Rust, and Lancer, a Rust-native web security testing suite.
|
|
| Skill | How I Use It |
|---|---|
| Rust | Where my own projects live — WP Pond (12-crate workspace + Tauri 2 GUI), Lancer (40+ crate workspace), Idorra, and 30 companion CLI tools |
| TypeScript | Strict TS end to end in NextCommerce — the NestJS API, the Next.js web app, and the Expo mobile client |
| NestJS | Modular REST APIs with JWT + Google OAuth, role-based guards, interceptors, and TypeORM over MySQL |
| Next.js / React | App Router front ends with Redux Toolkit and RTK Query for all data fetching |
| React Native | One Expo codebase sharing the web client's API and auth flow |
| PHP | Five years of production CMS backends, custom plugins, and eCommerce integrations |
| JavaScript | Chrome MV3 extensions built on the Chrome DevTools Protocol |
| Docker / Kubernetes | Multi-stage builds plus Deployment, Service, HPA, Ingress and StatefulSet manifests |
| RabbitMQ | Fanout event pipeline between an API and a standalone notifications service |
| Astro | My own site and blog, naymul.com |
🪷 WP Pond — Native Local WordPress Development, in Rust
|
My flagship project — a host-based (non-Docker) local development tool and an alternative to Local/LocalWP, built as a 12-crate Rust workspace with a Tauri 2 desktop GUI.
WP Pond supervises bundled PHP, MariaDB/MySQL, and nginx/Apache binaries directly on the host —
no Docker, no VM, no daemons. It routes Also ships site clone, export/import, blueprints, one-click admin login, an Xdebug toggle, Adminer, and Mailpit mail capture. Targets Windows and Ubuntu/Debian x86_64 (16.04+).
|
🛡️ Lancer — Rust-Native Web Security Testing Suite
|
A Rust-native web application security testing suite — my own take on what a Burp Suite alternative looks like when it's built for speed from the start. It's a Cargo workspace of 40+ crates: a TLS MITM proxy with CA management, interception and match-and-replace; SQLite-backed history and project files; repeater, intruder, decoder, comparer and sequencer tooling; a passive and active scanner with an out-of-band (OAST) client; a Rhai-based scripting engine; plus a desktop GUI and a headless CLI.
Crates for LLM/MCP scanning, eBPF probes, mobile and IaC analysis are scaffolded and in progress.
Status: early, active development — the roadmap lives in
Around it sits the Lancer toolkit: 30 public companion repos, each re-implementing a
standard security tool in Rust —
|
🛒 NextCommerce — Full-Stack Commerce Platform
|
A production-shaped full-stack commerce platform in one pnpm monorepo — four apps on a single API: a NestJS 10 backend (TypeORM + MySQL 8, JWT and Google OAuth, role-based guards, validation pipes), a Next.js 14 App Router web client (Redux Toolkit + RTK Query), a React Native / Expo mobile client, and a notifications service. The interesting part is everything around the features: RabbitMQ fanout events published on every order state change, Redis caching with graceful fallback, Pino structured logging and Prometheus metrics, multi-stage Docker builds, and Kubernetes manifests with an HPA — all gated by GitHub Actions running lint, type-check, tests and image builds.
|
| Project | What it is |
|---|---|
| 🔎 Idorra | Rust CLI for authorized IDOR and broken-access-control testing. Every request passes one choke point: scope allowlist → dry-run (on by default) → token-bucket rate limit → JSON audit log. Redirects disabled, no shared cookie jar, secrets redacted. |
| 🧪 Lancer toolkit | 30 public repos re-implementing standard security tools in Rust — sqlmap, nmap, subfinder, naabu, dnsx, frida, ghidra, semgrep, wireshark, mobsf and more. In development. |
| 🧩 Browser security extensions | Six Chrome MV3 extensions for authorized testing: Request Tamper & Replay, Client Storage Watch, SPA State Explorer, Role UI Diff, Hidden UI Revealer, postMessage Spy. |
| 🚦 Easy Redirect | Chrome extension that redirects blocked sites to a page of your choosing — domain, path, wildcard, keyword and regex rules, colour-coded groups, allowlist mode, and incognito control. |
| 🌐 naymul.com | My site and blog — Astro + Keystatic. |
- 💬 Let's talk shop — Rust, TypeScript, system design, or security tooling: I'm always up for a good technical conversation
- 🚀 Got an ambitious project? I'm always up for meaningful collaborations
- 📚 I teach what I know and learn from everyone I work with
- 🌟 Open source matters — let's build things that outlast us
📬 Drop me a line — always happy to talk shop!
When I'm not shipping code, you'll find me chasing the latest in tech, tinkering with a new framework, or soaking in Dhaka's vibrant street culture. For me, every commit is a chance to grow — both as an engineer and as a human.
"Building the future, one commit at a time." 🚀