Çağan Efe Çalıdağ

1. NOW

   Security tooling for an AI operator

   Where the two threads meet.

   cybersecurity-tools: recon, enumeration, OSINT and exploitation tooling built to be driven by a local LLM over MCP, running on a Kali machine, filling the gaps Kali leaves rather than cloning what it already does well. Standard library first, few dependencies beyond Python itself.

   Read-only by default. Anything that touches a target actively sits behind an explicit flag and is still non-destructive.

   Python

   MCP

   OSINT

   Recon

   Enumeration
2. JUL 2026

   Two pentesting certifications from CyberExam

   Earned in labs, not lectures.

   Certified Ethical Pentester and Certified Mobile Application Pentester, both from CyberExam. Verify CEP and Verify CMAP.

   Both came out of hands-on machines and flag captures under a one-to-one mentorship rather than coursework. Penetration testing, web and mobile application security, and reverse engineering.

   Penetration Testing

   Application Security

   Android

   Reverse Engineering
3. SINCE LATE 2025

   Into offensive security

   The point it stopped being a side interest.

   The turn had a specific cause: React2Shell (CVE-2025-55182), an unauthenticated RCE in React Server Components, scored CVSS 10.0 and disclosed in December 2025. Watching a critical-10 land in the exact stack I had been building in made the gap between writing software and understanding how it breaks very hard to ignore.

   Closing that gap turned out to be the most fun I have had programming. CTFs, reverse engineering, and the low-level mechanics underneath. I like the part where you reason, research, and keep finding workarounds until the flag falls out. Taking something apart purely to break it is, as far as I am concerned, a good way to spend an evening.

   CTFs

   Reverse Engineering

   Vulnerability Research

   Web Pentesting
4. 2025-2026

   Building things that do not phone home

   Local-first, self-hostable, offline where possible.

   A run of projects under one constraint: little to no telemetry, self-hostable by anyone, and working without a connection wherever that is possible.

   P.O.T.A.T.O, a local voice-driven AI tool operator. Bedroc, end-to-end encrypted notes you can host yourself. Utilities, so I would stop handing random websites my data for things a browser can do on its own.

   Python

   Svelte

   Docker

   Self-hosting
5. SINCE SEP 2025

   Université Paris-Saclay, BSc Computer Science

   First year down, two to go.

   Math-Info track, through 2028. The first year covered modular C++ programming, memory and pointers, data structures & algorithms, Python, data science and machine learning, networking and Linux fundamentals. Most of it turned out to be the groundwork for where I went next.

   C++

   Algorithms

   Python

   Machine Learning

   Networking

   Linux
6. 2023-2025

   MFINUE IT

   Support for 400+ delegates, then the person 'MFINUE Connect' ran through.

   First year on the IT team, providing technical support across a conference of more than 400 delegates.

   Second year I became the de facto maintainer of MFINUE Connect, the conference portal: new features, fixes and additions all went through me, and I finished the year with the highest commit share on the project. Not my official title, but it was the job.

   TypeScript

   React

   Maintainer
7. JUL-AUG 2023

   FMSS Bilişim, Developer Intern

   Learning alongside a full-stack team.

   This was the first time the pieces I had been learning separately (front end, back end, mobile...) lined up into one picture of how software actually gets built and shipped.

   Frontend

   Backend

   Mobile
8. JAN-FEB 2023

   Fibabanka, Web Development Intern

   Built an internal Agile board end to end.

   Built an internal agile task board end-to-end: a React front end with drag-and-drop cards, a Node.js and MongoDB back end, and WebSockets so everyone's view updated live instead of on refresh. Also contributed to UI decisions and discussions around how the team would use the tool.

   React

   Node.js

   MongoDB

   WebSockets
9. 2021-2024

   Coding Club, member then president

   Plus a detour through game development.

   Joined in 2021 and ran the club in 2023-24. Competed at UAA Codefest in 2022 as a duo.

   I also played around with game development using C# and Unity for a while. It didn't become a serious project, but it was a fun way to learn something outside the usual web development stack.

   C#

   Unity
10. 2020-2025

    Lycée Français Privé Saint-Joseph, Istanbul

    Graduated at 94.5/100.

    Five years on the French track, including the preparatory year, with a Certificate of Excellence in every one of them.

    The school did not offer AP courses at all, so I took four on my own: Calculus BC, Computer Science A, Physics C: Mechanics and Physics 1. I prepared for all four alongside the ordinary academic year rather than instead of it, and scored 5/5 on every one.

    Certified C1 in both working languages over the same period: IELTS Academic 7.5 and DALF C1.

    AP Calculus BC 5

    AP CS A 5

    AP Physics C 5

    AP Physics 1 5

    IELTS 7.5

    DALF C1
11. 2016-2019

    Notepad++, batch files, and the inspect panel

    Where the curiosity started.

    Around ten years old, writing simple web pages and batch scripts in Notepad++ and pulling other people's pages apart in the browser inspector to see what would break. I also spent a while convinced I could take Google down with enough ping requests. I could not.

    From 2018 it turned into something more deliberate: online courses on Python, web development and ethical hacking.

    Notepad++

    Batch

    HTML/CSS

    Python

Open to offensive security internships, and always happy to talk shop.