🛡️ Security Researcher · Bug Bounty Hunter · Founder of 2mny.com
I find weaknesses before attackers do. I'm a security researcher from Bangladesh 🇧🇩 hunting web vulnerabilities — and building the tools that make hunting repeatable: the 328-module bug bounty platform & commercial scanner at 2mny.com, open-source scanners, and OSINT that shows what attackers already know. Everything I build is defensive: detect it, prove it, fix it first.
| Focus | In practice | |
|---|---|---|
| 🎯 | Web Vulnerability Scanning | XSS · SQLi · SSRF · SSTI · command injection · subdomain takeover · OWASP Top 10 — CVSS-scored, evidence-backed |
| ⚡ | Bug Bounty Automation | Recon pipelines & deterministic engines that compress triage from days to minutes |
| 🕵️ | OSINT & Exposure Intel | Breach collections, stealer logs, username grids — know exactly what's already exposed |
Everything below is protection tooling — it finds weaknesses before attackers do, so website owners can fix them first. Detection, evidence, and a clear fix plan. Nothing I build is for attacking anyone.
The only web scanner that shows you what it did NOT check — fully-deterministic, self-hostable protection.
| 🧩 218 scanner modules | Finds XSS · SQLi · SSRF · SSTI · command injection · subdomain takeover · OWASP Top 10 risks |
| 🤖 AI-stack safety | MCP server auditing · LLM Top-10 exposure · agent panels · leaked AI keys |
| 📄 Evidence-backed reports | CVSS-scored findings, HTML/PDF, technical + customer variants |
| 🏠 100% self-hosted | One Docker command — no API keys, no token billing, no vendor lock |
| ⚔️ Battle-tested | False-positive guards, soft-404 baselining, WAF detection, ownership gating |
| ⚖️ Truly open | Apache-2.0 core, MIT tools only — free forever |
git clone https://github.com/RanaKhan77/website-vulnerability-scanner.git # your own 218-module protection labSelf-hosted personal exposure checker — is your email, username, phone or password leaked?
| 🔎 26 keyless sources | Breach collections · infostealer logs · COMB 11B+ credentials · HIBP k-anonymity · 200-platform username grid |
| 🔑 Zero API keys | No accounts, no rate-limit roulette, no telemetry — one Docker command and it runs |
| 🧠 Zero AI, on purpose | Deterministic three-state verdicts: exposed / clear / unavailable — a dead source never fakes a pass |
| 🔐 Privacy by design | Salted hashes + masked identifiers only; password checks match in your browser (k-anonymity) |
| 📄 Evidence reports | Printable per-source report with honest 0–100 exposure score — live landing page → |
| 📤 Data out (v1.1) | JSON + CSV export for every check · confidence-tiered username hits (confirmed vs probable) |
| 🩺 ec:doctor (v1.1) | One-command install self-test: 26-source reachability, storage, database, migrations — seconds, zero network cost |
git clone https://github.com/RanaKhan77/Exposure-Check-OSINT.git # know what attackers already knowA hand-curated, license-verified map of 1458 free cybersecurity protection tools — built for discovery.
| 🏰 14 themed realms | Pentest arsenal · hardening · threat intel · OSINT · DFIR · DevSecOps · AI security |
| 🔬 License-verified | Every flagship entry checked via GitHub API — copyleft/freemium tagged inline |
| 🆓 100% free | No paywalls, no AI-gated entries, no sponsored placements |
| 🔄 Quarterly re-verification | Dead links swept, activity re-checked, standards enforced |
⭐ If you defend systems for a living — or you're learning to — this is the shortcut list. — browse the realms →
⚡ 2MNY Security Scan — GitHub Action
Free CI security checks on every push — one line in your workflow.
| 🔍 What it checks | TLS/SSL health · security headers (HSTS/CSP) · cookie flags |
| 📄 What you get | A full evidence-backed report from 2mny.com, right in your Actions log |
| 🆓 Cost | Free — public repos, no API keys, no setup beyond one line |
- uses: RanaKhan77/2mny-security-scan@v1
with:
target: https://example.com🌐 2MNY Security — the managed protection platform
The full 328-module engine with continuous attack monitoring, attack-surface diffing and redacted customer reporting — plus a bug bounty platform — protecting teams that want the coverage without hosting it themselves. Run the free instant check at 2mny.com — no signup needed.
The curated map of Bangladesh's open source, open data and free APIs — community-built.
| 📚 What it is | 400+ verified entries across 14 sections — datasets, Bangla NLP, fintech SDKs, civic tech, crisis-response and everyday apps |
| ✅ Evidence-first curation | Every entry live-verified with licence + Bangladesh-connection evidence; no star counts, no fluff |
| 📖 Deep-dive guides | 14 section handbooks with editor's picks, plus a showcase site |
| 🤝 Community-built | Open contributions with a firm verification process — suggest, verify, correct |
⭐ The national directory for Bangladeshi developers — built to connect the whole ecosystem. — explore the list →
🛡️ Web App Protection Finds XSS · SQLi · SSRF · IDOR · auth flaws · race conditions — first
🔭 Attack-Surface Guard Subdomain takeover · cert mining · exposed JS secrets · recon exposure
🤖 AI Stack Safety MCP servers · LLM gateways · agent endpoints · vector DB exposure
🏗 CMS & Frameworks WordPress · Laravel · Django · Rails · Joomla · Magento
🔗 Supply Chain Safety OSV matching · outdated components · dependency risk
📡 Threat Monitoring Infostealer leaks · defacement watch · ransomware tracking
🕵️ Personal Exposure Email/username/phone/password/IP leak checks · breach & stealer-log intel
💻 Stack
Deterministic beats probabilistic in security. Same target → same findings, every run. Evidence a CISO can defend in court — not "the model said so."
- 🛡️ Protection first — every scanner, every list, every guide exists to keep people safe from attackers
- 🔓 Open source where it matters, honest telemetry over fake DRM
- 🎯 Ownership-gated intrusive testing — authorize properly, test responsibly
- 🇧🇩 Building from Bangladesh for the world — and giving back along the way
- 🔁 Ship daily, verify everything, measure what actually protects people
🔨 Shipping the next Community Edition batch — 218 modules and climbing
🛰️ Growing 2mny.com — the 328-module bug bounty platform & commercial scanner
📚 Curating awesome-cyber-security-heaven (1458 tools) & Awesome-Bangladesh
💬 Questions or ideas? → Community Discussions
⭐ If my tools helped protect your site — a star keeps the mission moving. ⭐
Built with stubborn engineering discipline · 🇧🇩 Bangladesh → 🌍 A safer web for everyone