software engineer · ingénieur logiciel · yazılım mühendisi

Toprak Yagcioglu

I build software, get paid to break backends that shouldn’t have trusted me, and keep failing to put the guitar down.

22 · 3rd-year B.Eng. Software Development · Uniwersytet WSB Merito Wrocław

open12-week internship · summer 2026 or winter 2026/27 · Erasmus+, France preferred

email[email protected]github@yagcioglutoprak hackerone@toprak_y cv.pdf ↓

§00

About

Toprak Yagcioglu, Wrocław, 2026 — Toprak · Wrocław · 2026

22. Born in Türkiye, three years in Wrocław for a software engineering degree. Most of my time goes to three things, in roughly this order: making, breaking, and an electric guitar.

The making is mostly done at 1 a.m. with three Claude tabs open. I lean on LLMs to ship more than I would on my own, vibecoding in the actual sense rather than the buzzword one, and most of what I publish is the second pass after the model’s first. The interesting work isn’t generating code, it’s wiring agents together: planners, specialists, custom MCP servers, the context-window discipline that keeps an agent from drifting into nonsense. Glitch is me trying to get that pipeline right. Dusty is the counterweight: small careful Swift that strangers actually install, where the entire pitch is “it will never delete the wrong thing.” TypeScript and Swift are home; Python when I need glue, C when I need the audio thread to behave.

The breaking is HackerOne, mitmproxy, and a particular kind of curiosity about the assumptions a backend was built around. Reverse-engineering apps and watching their traffic is, weirdly, the calmest part of my week. Amazon and Trendyol both received polite responsible-disclosure emails from me. It isn’t “hack the planet.” Every system has a fingerprint and reading it patiently is its own quiet thing.

The guitar is older than either. I started in my early teens, never stopped, and I keep coming back to Pink Floyd. Gilmour’s phrasing is the standard nobody really cleared. I work out Comfortably Numb, Echoes, Time, Shine On You Crazy Diamond by ear, slowly, until it stops feeling mechanical. One bend hit right beats ten notes fast. I built ToneForge because none of the rigs I owned sounded like the thing I heard in my head; the real-time DSP turned out to be its own rabbit hole.

The rest, briefly: Turkish coffee that I keep slightly burning, French I’m pushing toward B2 for the stage in France, and late-night practice that the neighbours have learned to tolerate.

§01 · Making

Ships

Four things built end to end and put in front of real users, in the order they happened. Two are closed source. The engineering detail is the part I can show; the rest I will walk through live.

01
N°01
2025 → now · solo
Öğrenci Nerede Yer
TESTFLIGHT BETA
Restaurant discovery, social feed, meal-buddy matching and real-time chat for students in Wrocław.
try it → testflight.apple.com/join/wTukQquP
sourceprivate repo · the TestFlight build is the proof, install it and poke at it
- ▹Designed end to end. Twenty Postgres tables underneath with RLS and SECURITY DEFINER RPCs, ten Zustand stores with optimistic updates on top. Real-time chat rides Supabase Realtime. The UI is glass-morphism React Native in strict TypeScript.
- ▹Ships to TestFlight through EAS Build and GitHub Actions, fingerprint-aware. Sentry carries a real error taxonomy rather than a pile of untriaged exceptions. Account deletion is GDPR-compliant and runs in an Edge Function.
stacktypescriptreact nativeexposupabasepostgreszustandsentrygithub actions
map · discover
feed · post
events · meet up
chat · realtime
02
N°02
2026 · solo · private alpha
GlitchAI-native HTTPS proxy & pentest workbench (macOS)
ACTIVE
Burp Suite and Claude Code, fused. Proxy + AI workers + autonomous scanner, scope-enforced per engagement.
sourceclosed while it is in private alpha · I will screen-share the proxy and the scanner on request
- ▹A crash-tolerant HTTPS proxy built on mitmdump, with content-addressed body storage. Right-click any request and it spawns a scoped claude -p subprocess with a custom MCP server attached.
- ▹A Python planner drives a specialist swarm for the autonomous scanner. Every finding lives on disk inside its own engagement directory. Delete the database and it rebuilds itself from those files.
stackelectrontypescriptpythonmitmproxymodel context protocolsqlite
03
N°03
2026 · solo · open-source
DustymacOS menu-bar disk cleaner, signed & notarized
SHIPPED · v1.0
Free, open-source CleanMyMac alternative. Shows every path and its size before deleting, and only ever touches a fixed allowlist.
star it → github.com/yagcioglutoprak/dustysee it → toprak.sh/dusty
sourceopen · MIT · signed, notarised, and on a Homebrew tap
- ▹A pure-Swift CleanerEngine built around an allowlist-only SafetyValidator. There is no “clean everything” button. Every target is a known cache, log or dev-junk path, and the engine refuses anything off the list by construction.
- ▹A concurrent three-level scan, Safe through Developer to Deep, covering Xcode DerivedData, stale simulators, npm, pip, cargo and brew caches, and local Time Machine snapshots. Signed with a Developer ID, notarised by Apple, shipped through a Homebrew tap.
stackswiftswiftuimenubarextraswift package managerxcodegenhomebrew
04
N°04
2026 · solo
ToneForgelive guitar rig for Mac, real-time DSP in C
SHIPPED
Standalone guitar effects processor: 29 effects, 118 presets, 9 amp models, ~8 ms round-trip latency.
sourceclosed for now · signed build and a code walkthrough on request
- ▹The real-time DSP is C with lock-free atomic parameters. Nothing allocates, nothing locks, and no Objective-C dispatch ever touches the audio thread. AVAudioEngine and everything above it are Swift.
- ▹A WSOLA octaver, a YIN harmoniser, an autocorrelation tuner, Fuzz Face and Big Muff models, and tube-saturation amps with real tonestack values. The pedalboard is SwiftUI, with MIDI and a 60-second looper.
stackswiftswiftuiavaudioenginecustom c dspcoremidi

§02 · Breaking

Breaks

A short ledger of disclosed bug-bounty findings. Building things teaches you how to break them; breaking them teaches you how to build them properly.

BRK-AMZRESOLVEDHackerOne
Amazon
Found it, wrote it up, sent it in. Amazon's security team triaged it, patched it and closed it out. The interesting half stays inside the programme, which is the trade you make for being allowed to look in the first place.
HackerOne · @toprak_y
BRK-TRDRESOLVEDHackerOne
Trendyol
Same story, different target. Reported, triaged, patched, closed. I would rather walk you through this one in person than write around the same NDA twice.
HackerOne · @toprak_y
full programme details · talk to me directly.