Mikhail Karan
Head of Engineering & Lead Developer at Cyfrin · Milton, Ontario
Co-host of HTML All The Things · weekly since 2018, ~500 episodes
I was Cyfrin's first engineering hire. I built the team, the platform, and most of the products running on it.
Six products, one monorepo, a small remote team, and a lot of Svelte.
The short version
-
First engineer → Head of Engineering
Joined as hire #1 with no engineering org to inherit. Grew and led a fully remote, async-first team of roughly nine across six concurrent products — hiring, on-call, delivery, and the hard conversations included.
-
Six products, built or led every one
A competitive audit platform, an education platform, unified identity/SSO, an acquired vulnerability database, a jobs board, and an AI security agent — all on one Turborepo monorepo.
-
Designed to run itself
Tens of thousands of active users on a platform that needs roughly one bug fix a quarter. Self-serve pipelines for non-engineers instead of tickets that route through engineering.
-
AI in production, not in a deck
Led Cygent from first commit to paying customers in about seven months: per-tenant sandboxed agents, blue-green orchestration, self-serve provisioning, and the eval work to know it actually got better.
-
Security is the job, not a checklist
Owned SOC 2 Type II solo, end to end. Turned ad-hoc white-hat reports into a standing pen-test program. Incident commander for every severe incident, with a retro every single time.
-
~500 episodes and counting
Co-host of HTML All The Things since 2018 — weekly conversations about web development, AI, and building a career in this industry. Still shipping every week.
What I've built
Cygent
2025 → nowEngineering lead
An AI security engineer a company hires like a team member — it joins your Slack, Discord, Telegram, GitHub and Linear, builds context on your codebase continuously, flags smart-contract foot-guns during development, and runs full audits.
- Security-hardened agentic system: one isolated, sandboxed Docker environment per agent, each with its own compute and privileges, running 24/7
- Orchestrator handling per-tenant instance lifecycle — provisioning, health checks, blue-green deploys, webhook routing, multi-host
- Self-serve portal: Stripe purchase to a provisioned agent in seconds
- Agentic tool loop with engagement scoring, conversation state, and a per-user memory system
- Custom Postgres primitives — job queue, KV with TTL, and vector search — instead of three more vendors
- Auto pen-test "battle system": red/blue team exploit testing in ephemeral sandboxes
- From first commit to paying customers in ~7 months
Cyfrin Updraft
2023 → nowLed development
The leading web3 education platform — fully custom, not an off-the-shelf LMS. Tens of thousands of active users and consistent monthly signups with essentially no marketing spend.
- Video player built bottom-to-top, with delivery and analytics through Mux
- Course progression engine handling mixed video and written lessons, plus a custom quiz system
- Fully proctored certification flow with payments — industry certifications that generate direct revenue
- Video-level and platform-level sponsorships with their own analytics pipelines
- Self-serve course-launching pipeline so the education team ships courses without engineering
CodeHawks
2023 → nowBuilt from zero as first engineering hire
Cyfrin's first product bet and the reason I was hired: a competitive audit platform where companies post codebases as contests and independent security researchers compete to find vulnerabilities for rewards.
- Contest dashboard covering codebase analysis through findings submission
- From-scratch judging system for evaluating every finding — validity, severity, duplicates
- Automated rewards calculator computing payout splits across finding counts, severity, and duplicates
- Hired the first additional engineer within months and moved into a tech-lead role on the product
Solodit
2024Solo migration
An acquired React app — a searchable database of smart contract vulnerabilities aggregated from audit reports across the industry. I rebuilt and migrated it single-handedly.
- Rebuilt backend and frontend from the ground up, React → SvelteKit
- Wired into the shared profiles/SSO system
- Custom scrapers per audit firm to ingest vulnerability reports, plus a GitHub-based submission pipeline for firms to submit their own
- Done pre-agentic-AI — hand-written, ChatGPT-era at best
Unified identity
2024Architected, managed the owning engineer
Four separate apps became one platform. A standalone profiles application acting as the SSO/identity hub for the whole ecosystem — log in once, logged in everywhere.
- One account across education, competitive audits, vulnerability research, and jobs
- Dedicated profiles service and schema behind it
- Hired and managed the engineer who owned it
Jobs board
2025Rescued and delivered
An end-to-end hiring platform tied to Cyfrin profiles: companies purchase and post jobs, candidates apply, an LLM pre-screens before handoff to the company ATS. It was off track; I stepped in late and drove it to an on-time launch.
- Full purchasing workflow for companies posting jobs
- LLM candidate pre-screening ahead of ATS handoff, with integrations syncing companies’ own listings into the board
- Made the speed-vs-longevity calls, managed the tech debt deliberately, re-organized the work
- Shipped on schedule. Traction was modest — the rescue and the trade-off management are the achievement, not the outcome
Leading, and the unglamorous parts
SOC 2 Type II, owned solo
Enterprise deals for an AI agent need it — nobody hands a bot their repos and Slack without one. Cyfrin had no compliance function, no HR, no IT, so the whole program needed a single owner. Stood it up, drove the company to audit-ready in about two months, then through the observation window and the audit itself. Certified with zero findings, alongside leading engineering.
Incident command
Led every severe-issue war room over three years: called it, coordinated the response, handled messaging, delegated workstreams, and closed with a retrospective every time. Hot-fixes inside the hour — a self-inflicted API stampede diagnosed and patched 33 minutes after the first user report. No war room ever repeated a root cause.
A continuous pen-test program
White-hat researchers were reporting issues organically, so I turned those relationships into a standing group continuously attacking our platforms, paid per bug. Every new app shipped got the same adversarial treatment. A grey-box assessment of the agent container isolation surfaced critical escape vectors — in the dev environment, before any customer exposure.
DDoS mitigation that held
A high-traffic public platform in an adversarial space gets attacked. Worked with Vercel on initial mitigation, then designed our own protection layered on top. The attacks kept coming and stopped landing.
Culture that shipped features
Internal hackathons run as both a morale reset and a real product pipeline — projects graduated into production platform features. Weekly show-and-tell to keep a distributed team connected to each other’s work.
Sales engineering
Cygent is a technical product sold to technical buyers, with no sales-engineering function to lean on. Ran live demos and technical Q&A on roughly thirty calls — sandboxing, permissions, integrations, the questions that decide whether a security company gives you repo access — converting half to trials. Then built the demo flow and materials so sales could run those calls without an engineer in the room.
Engineering the go-to-market motion
The other half of that job is building the machine instead of sitting in every call. Shipped the self-serve funnel that turns a Stripe checkout into a live, provisioned agent in seconds — no human in the loop. Built LLM pre-screening wired into customer ATSs, sponsorship pipelines with their own analytics, and course-launch tooling the education team runs without filing a ticket. Same pattern every time: sit in the revenue conversation, find the manual step, automate it, instrument it so you know whether it worked.
What I work with
- core/
- TypeScriptJavaScriptNodeBunPython
- frontend/
- Svelte 5SvelteKitVueReactStorybookCSS
- backend/
- tRPCPrismaDrizzlePostgrespgvectorRESTwebhooks
- infra/
- VercelDockerTurborepopnpmCloudflareDatadogVitest
- ai/
- LLM orchestrationagent evalsMCPE2B sandboxesRAG
- leading/
- hiringremote/async teamson-call designincident commandSOC 2
Where I've been
- 2023 → now
Cyfrin — Head of Engineering & Lead Developer
First engineering hire → tech lead → Head of Engineering. All of engineering: architecture and delivery across the whole product platform, while staying hands-on as lead developer.
- 2018 → now
HTML All The Things — Co-host
Weekly web development podcast with Matt Lawrence. Nearly 500 episodes on web dev, AI, freelancing, and building a sustainable career in tech.
- before Cyfrin
Digital Dynasty Design — Co-founder
Started a web development agency straight out of college and ran it for the better part of a decade — client work, small business realities, and the responsive-web-design era end to end.
- 2014 – 2017
McMaster University — B.Tech, Software Engineering Technology
Where the agency idea started.
HTML All The Things
A podcast for developers navigating the modern web industry, with my co-host Matt Lawrence. We started it in 2018 partly to find community, and never stopped — web development, the AI-driven shifts in the industry, freelancing, and what it actually takes to build a career in this field.
- ~500 episodes
- 1M+ downloads
- weekly since 2018
- 117 articles on DEV
Get in touch
- email mikhail.karan@gmail.com
- github mikhail-karan
- linkedin mikhail-karan-hatt
- podcast htmlallthethings.com
- dev.to mikehtmlallthethings
- x @htmleverything