mikhail@cyfrin:~$ whoami

Mikhail Karan

Co-host of HTML All The Things · weekly since 2018, ~500 episodes

Head of Engineering & Lead Developer at Cyfrin · Milton, Ontario

Cyfrin's first engineering hire. I built the team, the platform, and most of the products on it.

Six products, one monorepo, a small remote team, and a lot of Svelte.

mikhail@cyfrin:~$ ./podcast --stats

HTML All The Things

A podcast for developers navigating the modern web industry, with my co-host Matt Lawrence. Started in 2018 to find community and never stopped — web development, the AI-driven shifts, freelancing, and what building a career in this field actually takes.

  • ~500 episodes
  • 1M+ downloads
  • weekly since 2018
  • 117 articles on DEV
mikhail@cyfrin:~$ cat highlights.md

The short version

  • First engineer → Head of Engineering

    Hire #1, no engineering org to inherit. Grew and led a remote, async-first team of nine across six concurrent products — hiring, on-call, delivery, and the hard conversations.

  • Six products, built or led every one

    Competitive audits, education, unified SSO, an acquired vulnerability database, a jobs board, and an AI security agent — one Turborepo monorepo.

  • Designed to run itself

    Tens of thousands of active users, roughly one bug fix a quarter. Non-engineers ship through self-serve pipelines instead of tickets.

  • AI in production, not in a deck

    Cygent, first commit to paying customers in seven months: per-tenant sandboxed agents, blue-green orchestration, self-serve provisioning, and the evals to know it got better.

  • Security is the job, not a checklist

    SOC 2 Type II owned solo. Ad-hoc white-hat reports turned into a standing pen-test program. Incident commander on every severe incident, retro every time.

  • ~500 episodes and counting

    Co-host of HTML All The Things since 2018 — weekly, on web development, AI, and building a career in this industry.

mikhail@cyfrin:~$ ls -l ~/work

What I've built

  • Cygent

    2025 → now

    Engineering lead

    An AI security engineer you hire like a team member. It joins Slack, Discord, Telegram, GitHub and Linear, builds context on your codebase, flags smart-contract foot-guns during development, and runs full audits.

    • One isolated, sandboxed Docker environment per agent — own compute, own privileges, running 24/7
    • Orchestrator for per-tenant lifecycle: provisioning, health checks, blue-green deploys, webhook routing
    • Self-serve portal — Stripe checkout to a provisioned agent in seconds
    • Agentic tool loop with engagement scoring, conversation state, and per-user memory
    • Custom Postgres primitives — job queue, KV with TTL, vector search — instead of three more vendors
    • Auto pen-test "battle system": red/blue team exploit testing in ephemeral sandboxes
    • First commit to paying customers in ~7 months
    agent dashboard The Cygent dashboard for a project called bug-bench: counters for audits, active issues and findings by severity, quick actions to start an audit or a pen-test, the agent behaviour panel, and a feed of completed audits and scheduled threat scans.
    • Bun
    • TypeScript
    • SvelteKit
    • Drizzle
    • Postgres + pgvector
    • Docker
    • E2B
    • MCP

  • Cyfrin Updraft

    2023 → now

    Led development

    The leading web3 education platform — fully custom, not an off-the-shelf LMS. Tens of thousands of active users on essentially no marketing spend.

    • Video player built bottom-to-top, delivery and analytics through Mux
    • Course progression engine for mixed video and written lessons, plus a custom quiz system
    • Proctored certification flow with payments — industry certs that generate direct revenue
    • Video-level and platform-level sponsorships with their own analytics pipelines
    • Self-serve course launching, so the education team ships without engineering
    lesson player A Blockchain Basics lesson on Cyfrin Updraft: video and written lesson tabs above the player, the lesson description below it, and a course outline in the sidebar with section progress and per-lesson durations.
    • SvelteKit
    • Svelte 5
    • TypeScript
    • Statamic CMS
    • Mux
    • Stripe
    • tRPC
    • Prisma

  • CodeHawks

    2023 → now

    Built from zero as first engineering hire

    Cyfrin's first product bet and the reason I was hired: companies post codebases as contests, independent security researchers compete to find vulnerabilities for rewards.

    • Contest dashboard from codebase analysis through findings submission
    • From-scratch judging system for every finding — validity, severity, duplicates
    • Rewards calculator computing payout splits across finding counts, severity, and duplicates
    • Hired the first additional engineer within months, then moved into tech lead on the product
    contest page A CodeHawks contest page for an audit called BattleChain Confidence Pools: scope tags and contest dates on the left, a prize pool breakdown with the per-severity payout split on the right, and the contest timeline running from live through judging and appeals to rewards distribution.
    • SvelteKit
    • TypeScript
    • tRPC
    • TanStack Query
    • Prisma
    • Postgres
    • Vercel

  • Solodit

    2024

    Solo migration

    An acquired React app — a searchable database of smart contract vulnerabilities pulled from audit reports across the industry. I rebuilt and migrated it single-handedly.

    • Backend and frontend rebuilt from the ground up, React → SvelteKit
    • Wired into the shared profiles/SSO system
    • Per-firm scrapers ingesting vulnerability reports, plus a GitHub submission pipeline for firms
    • Done pre-agentic-AI — hand-written, ChatGPT-era at best
    findings search Solodit searching smart contract vulnerabilities: impact, quality, rarity and source filters down the left, a results list of over fifty thousand findings in the middle, and the selected finding’s severity, description and affected code on the right.
    • SvelteKit
    • TypeScript
    • tRPC
    • Prisma
    • web scraping
    • ingestion pipelines

  • Unified identity

    2024

    Architected, managed the owning engineer

    Four separate apps became one platform. A standalone profiles app as the SSO hub for the whole ecosystem — log in once, logged in everywhere.

    • One account across education, competitive audits, vulnerability research, and jobs
    • Dedicated profiles service and schema behind it
    • Hired and managed the engineer who owned it
    shared profile A Cyfrin profile page: one account showing CodeHawks earnings, ranking and finding counts next to Updraft course progress, with cross-links into both products from the sidebar.
    • SvelteKit
    • tRPC
    • Prisma
    • auth/session architecture

  • Jobs board

    2025

    Led development

    A hiring platform tied to Cyfrin profiles: companies buy and post jobs, candidates apply, an LLM pre-screens before handoff to the company ATS.

    • Full purchasing workflow for companies posting jobs
    • Integrations syncing companies’ own listings into the board
    • SvelteKit
    • Stripe
    • LLM screening
    • ATS integrations
mikhail@cyfrin:~$ ls ~/side

Nights and weekends

  • Elevator Operator

    [playable]

    A browser game where you are the elevator. Passengers spawn with a destination and a patience meter — batch the pickups well or eat a strike when someone gives up waiting.

    The simulation is a pure, deterministic, tick-based module with no DOM imports: tick(state, commands, dt) returns the next state and the events. Game logic stays unit-tested, the renderer stays swappable. Canvas 2D, seeded RNG, zero runtime dependencies.

    a shift in progress Elevator Operator mid-game: a cutaway of an eight-floor building with passengers waiting on floors 1, 4 and 8, the car stopped at floor 6 with its doors open and three riders inside, a brass call panel beside the shaft, and a side panel showing a score of 159, one strike, and forty seconds elapsed.
    • TypeScript
    • Vite
    • Canvas 2D
    • Vitest
    • no runtime deps

  • Language Learner

    [invite-only, in use]

    A voice tutor built for one person — a Russian speaker learning elementary English talks to an AI tutor out loud, and gets a written review afterwards.

    OpenAI Realtime over WebRTC: audio goes browser to OpenAI, the server only signals. Sessions persist transcripts, a learner profile, and corrections that feed the next warm-up. Tests apply the real migrations to an in-process PGlite database, so they cannot drift from what deploys to Neon.

    a session in progress A live session in Language Learner: a running transcript alternating between the tutor and the learner in English, pause and end buttons under it, a note that saying “pause please” out loud works too, and a privacy notice in Russian explaining that the administrator can see the conversations.
    • SvelteKit
    • TypeScript
    • OpenAI Realtime
    • WebRTC
    • Drizzle
    • Neon
    • Better Auth
    • PWA

  • Drain

    [prototype]

    A macOS menu bar app that tells you why the battery is draining. I lost 20% in an hour to a runaway node process and two editor extension hosts, and nothing surfaced it.

    Samples power draw through IOPowerSources, per-process CPU and memory through proc_pidinfo, compressor pressure through host_statistics64. When the thresholds hold for a minute it fires one notification with Kill, Snooze and Ignore on it. The rest of the time it says nothing, which is the actual feature.

    • Swift
    • SwiftUI
    • IOKit
    • macOS
mikhail@cyfrin:~$ cat leading.md

Leading, and the unglamorous parts

  • SOC 2 Type II, owned solo

    Nobody hands a bot their repos and Slack without it, and Cyfrin had no compliance function, no HR, no IT. Stood the program up, drove the company to audit-ready in two months, then through the observation window and the audit. Certified with zero findings, alongside leading engineering.

  • Incident command

    Led every severe-issue war room over three years: called it, coordinated the response, handled messaging, ran the retro. Hot-fixes inside the hour — a self-inflicted API stampede patched 33 minutes after the first user report. No root cause ever repeated.

  • A continuous pen-test program

    Turned organic white-hat reports into a standing group attacking our platforms, paid per bug. Every new app got the same treatment. A grey-box assessment of the agent container isolation surfaced critical escape vectors — in dev, before any customer exposure.

  • DDoS mitigation that held

    A high-traffic public platform in an adversarial space gets attacked. Mitigated with Vercel, then designed our own protection on top. The attacks kept coming and stopped landing.

  • Culture that shipped features

    Internal hackathons as both morale reset and product pipeline — projects graduated into production platform features. Weekly show-and-tell to keep a distributed team connected.

  • Sales engineering

    Cygent is a technical product sold to technical buyers, with no sales-engineering function to lean on. Ran demos and technical Q&A on ~30 calls — sandboxing, permissions, integrations, the questions that decide whether a security company gives you repo access — converting half to trials. Then built the demo flow so sales could run those calls without an engineer.

  • Engineering the go-to-market motion

    The other half of that job is building the machine instead of sitting in every call. Shipped the self-serve funnel — Stripe checkout to a live, provisioned agent, no human in the loop — plus LLM pre-screening into customer ATSs, sponsorship pipelines, and course-launch tooling. Same pattern every time: find the manual step, automate it, instrument it.

mikhail@cyfrin:~$ tree ~/stack

What I work with

core/
TypeScriptJavaScriptNodeBunPython
frontend/
Svelte 5SvelteKitVueReactStorybookCSS
backend/
tRPCPrismaDrizzlePostgrespgvectorRESTwebhooks
infra/
VercelDockerTurborepopnpmCloudflareDatadogVitest
ai/
LLM orchestrationagent evalsMCPE2B sandboxesRAG
leading/
hiringremote/async teamson-call designincident commandSOC 2
mikhail@cyfrin:~$ cat experience.log

Where I've been

  1. 2023 → now

    Cyfrin — Head of Engineering & Lead Developer

    First engineering hire → tech lead → Head of Engineering. Architecture and delivery across the whole product platform, still hands-on as lead developer.

  2. 2018 → now

    HTML All The Things — Co-host

    Weekly web development podcast with Matt Lawrence. Nearly 500 episodes on web dev, AI, freelancing, and careers in tech.

  3. 2022 – 2023

    Molekule — Senior Frontend Developer

    Contract, remote. Brought in to fix the e-commerce frontend and led the team doing it — less UI friction, more sales. The bottleneck then moved to the backend, so I moved with it. Nuxt and Vue on the front, Magento behind it.

  4. 2021 – 2022

    Solarians — Project Lead Developer

    Remote, on-call. Solana NFT project: designed the on-chain interaction systems, built the TypeScript endpoints for wallet connection, and shipped an app for customizing animated on-chain NFTs. Ran a team of developers and designers, and fronted dev updates to the community.

  5. 2018 – 2021

    Contentlinq — Technical Lead

    Contract, full-time. Designed the frontend systems and led four developers and a designer, building VueJS, Cordova, Flutter and PHP applications for corporations deploying into secure environments.

  6. before Cyfrin

    Digital Dynasty Design — Co-founder

    Started a web development agency out of college and ran it for the better part of a decade — client work, small business realities, the responsive-web era end to end.

  7. 2014 – 2017

    McMaster University — B.Tech, Software Engineering Technology

    Where the agency idea started.

mikhail@cyfrin:~$ cat contact.env

Get in touch