Start a conversation
Darkul

I build software from Mirpur, Dhaka, and run a small studio for clients abroad.

Full-stack web over Postgres, server-side tracking, and self-hosted tooling. This site runs on my own machine, behind my own nginx — the numbers above are read from it, not typed in.

Writing

All 3 →
  1. 003Your agent's permission check only guards its own doorA permission check only governs the calls that pass through it. This week I read a case study where an agent was denied access to a config file, the check held, and the file changed anyway.
  2. 002The AI wrote it confidently and it was completely wrongThe code looked right. It compiled. The variable names made sense. The API it called does not exist. I've stopped being surprised by this. I've started building around it instead.
  3. 001Your build config is code, so review it like codeSomeone ran git pull, then npm run build, and got malware. No new package, no strange file opened. The payload was sitting in vite.config.js, carried in by a merge commit that looked legitimate.

Start a conversation

Custom web apps, server-side tracking, and VPS work. Tell me what you are building and I will tell you whether I am the right person for it.

Or reach me directly: hello@darkul.com · WhatsApp