Verified proof of work
Portfolio of verified work
Automation projects, a CVSS 7.1 OAuth disclosure, and open-source offensive tools, all built and tested by Zubair Usman. Each entry explains what the work does and how it was verified.
Responsible disclosure
Windsurf OAuth flaw
An OAuth flow weakness in the Windsurf editor was reported with a CVSS 7.1 severity rating. The write-up covers how the flaw was reproduced, why it mattered, and the mitigation steps to take.
CVSS 7.1
Severity of the Windsurf OAuth flaw
Reported as a responsible disclosure. Technical steps and mitigation guidance are summarised for developers who need to close the same gap.
Proof of work
Proprietary automation builds
Network automation
VPN Manager v9
A Python tool that manages VPN profiles and connection checks, cutting out repetitive manual setup steps.
Business systems
KYAZZ ERP
An ERP automation build that streamlines routine records, reporting, and workflow handoffs for small teams.
AI agents
Hermes AI agents
Task agents that run research and checks in sequence, reporting results back for review.
Developer tooling
Smart Cursor 2.0
An editor helper that automates repeated code edits and keeps project context close at hand.
Messaging automation
WhatsApp automation
Scripted message flows that handle routine replies and route requests to the right queue.
Open source
Open-source offensive toolkits
MalwareGuard-AI
An AI-assisted scanner that flags suspicious malware patterns for analyst review.
LocalCodex-AI
A local code assistant that runs offline, so source code never leaves the machine.
offsec-toolkit
A collection of helper scripts for recon, enumeration, and reporting during tests.
BugDrillX
A bug-hunting helper that organises checks and records findings in a repeatable format.