Volodymyr ShkarbanSoftware engineerLet’s talk

Full-stack engineering & AI-agent security

What it promises.
What it does.
The gap is my job.

I’m Volodymyr, a software engineer. I build full-stack products, and I test AI agents and the tools they call. When something is wrong, I bring a reproduction, a small fix with tests, and a clear line between what I tested and what I didn’t.

Discuss a role or project See the work
CreditedCVE-2026-95854 in CircleCI’s MCP server
Volodymyr Shkarban
Volodymyr ShkarbanSoftware engineer
Focus
Full-stack products, AI-agent security
Works with
US and European teams, remote
Contracts
B2B through a US LLC
Languages
English, Ukrainian, Russian, German

What I can do

Each one links to work you can check.

  • Find security gaps in AI-agent tools, and fix them.I read permission, approval and annotation code against what its docs promise, reproduce the gap, and send a small patch with tests.

    CVE-2026-95854 · CircleCI10 vendor disclosuresGerfach case study

  • Measure security across a whole ecosystem.Co-wrote a 37-page empirical study with Oleksandr Leontiev: 424 AI-agent tool endpoints across six protocols, each scanned five times.

    The study

  • Build security tools from scratch.An agent-security scanner with 39 audit modules and JSON/SARIF reports, and a zero-knowledge secrets manager with client-side AES-256-GCM encryption, RBAC and audit logs.

    Scanner in action

  • Build and run full-stack products in production.Primary engineer on a B2B fintech platform whose payment workflows processed more than €1M: Node.js and TypeScript, Next.js, PostgreSQL, external APIs, deployments, and production support.

    Fintech work

  • Connect payments and outside data so they stay correct.Stripe and Adyen webhooks with idempotency, retries and reconciliation. More than 30 external APIs and data providers across client projects.

    Payment sync sampleKestra signed webhooks

  • Test AI models the way an attacker would.About 70 adversarial evaluation tasks with reference solutions: prompt and tool injection, authorization boundaries, consent bypass, unsafe tool execution.

    AI safety contract

  • Stay with a system when it breaks.Helped recover a compromised Linux, Docker and Nginx environment overnight. Earlier, diagnosed faults and outages in GPS telemetry systems and cut a query on an 800 GB database from 600 to 360 ms.

    Delivery stories

  • Work directly with the people who need it.Scoping, explaining and troubleshooting with client teams in the US and Europe, from first requirement to handoff.

    How I work

Track record

Most recent first.

  1. In disclosure

    Private security reports with patches to three AI-agent projectsEach with a reproduction, tests and a fix. I will name them once the maintainers have closed them.

  2. Under review

    Pull request to Kestra: signed webhook triggers ↗Optional HMAC validation on the original request bytes, with 61 focused tests.

  3. Published

    Gerfach investigation: a “read-only” tool that wrote a fileControlled test, filesystem evidence, and a rerun after the fix.

  4. Credited · CVE-2026-95854

    CircleCI security advisory ↗Three MCP tools that rerun or roll back pipelines were missing the destructiveHint annotation. Fixed in version 0.18.0.

  5. AI safety contract

    About 70 adversarial evaluation tasks for a US AI companyTasks, reference solutions, and code review for injection, authorization and unsafe tool use.

  6. Disclosed · 90-day window closed 20 July

    Coordinated disclosures to 10 MCP server vendorsAnthropic, CircleCI, Sentry, MongoDB, Vercel, Salesforce and Heroku, Shopify, Qase, Railway, and Upstash. Findings included hidden parameters, “read-only” annotations on tools that write, and tool descriptions that steer the model. CircleCI published CVE-2026-95854. Sentry replied that they would fix theirs.

  7. Manuscript · pre-publication

    “Across the Protocol Stack”, with Oleksandr LeontievAn empirical security analysis of 424 AI-agent tool endpoints across MCP, REST, GraphQL, gRPC, OpenAI Functions and LangChain tools.

  8. Production

    Primary engineer on a B2B fintech platformPayment workflows that processed more than €1M, reconciliation, tenant-scoped access, deployments, and an overnight recovery of a compromised server.

  9. Open source

    Payment sync sample, published ↗Stripe webhooks, Redis idempotency, PostgreSQL and a CRM sync with retries, adapted from a client project.

  10. Independent

    Started Gerfach, an agent-security assessment CLI39 audit modules across seven protocol and tool families, with JSON and SARIF reports.

  11. Product

    Built a zero-knowledge secrets managerClient-side AES-256-GCM encryption so the server never sees plaintext, RBAC with audit logs for multi-org teams, and a self-hosted Docker Compose setup.

  12. Contract work

    Independent client projects for US and European teamsServices, integrations and data pipelines, including one batch job cut from about 12 hours to under 3.

  13. Operations

    Telemetry support at U-Monitoring GPS, KyivFaults, slow queries and outages around an operational database of about 800 GB. Cut one query from 600 to 360 ms.

  14. First clients

    Started building websites and automations for paying clientsThe start of everything above.

Selected work

What I was responsible for, and what changed because of it.

Security advisory · CircleCI MCP server · Credited

Telling AI clients which CircleCI tools need a confirmation.

CircleCI’s MCP server exposed three tools that rerun workflows or roll back pipelines, without the destructiveHint annotation that tells AI hosts to ask before running them. I reported it in April. CircleCI added the annotations in version 0.18.0 and published the advisory.

Advisory
CVE-2026-95854, medium
Fixed in
@circleci/mcp-server-circleci 0.18.0
Read the story The advisory

Before

ToolRoll back pipeline
AnnotationNone
AI hostMay run it without asking

0.18.0

ToolSame three tools
AnnotationMarked destructivedestructiveHint
AI hostCan ask first
The three tools: run_pipeline, rerun_workflow, run_rollback_pipeline. Published 20 July 2026, CVSS 4.4.

Research · Manuscript with Oleksandr Leontiev · Pre-publication

How secure are the tools AI agents call?

“Across the Protocol Stack” scans 424 tool endpoints across six protocols, five times each, with my scanner. MCP endpoints scored lowest and gRPC highest, and the difference between protocols was statistically significant. Passive schema checks rated endpoints about 6.7 points safer than active runtime tests did, so reading the schema alone is not enough.

Corpus
424 endpoints, 6 protocols
Status
37-page manuscript, not yet peer reviewed
Ask me for the manuscript

Mean security score by protocol

  1. gRPC55.8n=42
  2. GraphQL53.8n=46
  3. REST / OpenAPI41.6n=191
  4. OpenAI Functions38.1n=54
  5. LangChain tools35.8n=43
  6. MCP25.3n=48
Out of 100, higher is safer. Kruskal–Wallis H = 38.7, p < 0.001; largest gap gRPC vs MCP, Cohen’s d = 1.39.
Show as a table
ProtocolMean scoreEndpoints
gRPC55.842
GraphQL53.846
REST / OpenAPI41.6191
OpenAI Functions38.154
LangChain tools35.843
MCP25.348

Case study · Gerfach · Independent

Checking whether a “read-only” tool can write.

I built a TypeScript scanner for AI agents and their connected tools. In a controlled local test, a filesystem check confirmed a write. A runtime policy stopped the same probe on the rerun.

Result
1 file written, then 0
Built with
TypeScript, MCP, Bun
Read the case study

Before

Tool saysRead-onlyreadOnlyHint
ScannerCalls write_file
Disk1 file added

After

PolicyWrites rejected
ScannerSame probe
Disk0 files added
Actual result, 20 September 2026. Local fixture.

Open source · Kestra · Pull request #19659

Signed webhooks for Kestra triggers.

Optional HMAC signature validation for the Webhook trigger. Requests with a missing or invalid signature get a 401 before any execution is created. The check runs on the original request bytes, because parsing the JSON first would change what was signed.

Status
Open, waiting for review
Tests
61 focused tests passing
View the pull request

Signed

RequestValid signatureSHA-256
CheckRaw bytes match
KestraExecution runs

Unsigned

RequestMissing or wrong
CheckMismatch
Kestra401, no execution
SHA-1, SHA-256 and SHA-512, with a configurable header, prefix and secret. Webhooks without a signature setting behave as before.

Contract · Confidential fintech platform

A business-data product, from interface to infrastructure.

A platform for German business clients needed consistent company data, useful dashboards, and reliable operations. I owned work across the application, APIs, database models, and deployment.

Result
~30% smaller browser bundle
Built with
Next.js, React, Node.js, AWS
Scope and engineering decisions

I normalized external company and ownership records into shared models, implemented role-based access, and built customer dashboards and internal tools.

Production ownership covered Linux, AWS, Docker, and Nginx. Implementation decisions were made independently with team peer review. I also collaborated on AI-assisted extraction and discrepancy checking.

Client details stay confidential. The diagram shows my scope across the system, not the client’s interface.

InterfaceDashboards, admin tools
ServicesAPIs, role-based access
DataProvider records, shared models
ProductionAWS, Linux, Docker, Nginx
Four layers, one owner. The modernization cut the browser bundle by about 30%.

Writing

What I found, what maintainers said, and what I would do differently.

  1. Why three CircleCI tools now ask before they runThe story behind CVE-2026-95854: what an MCP tool annotation is, what CircleCI changed, and what I would do differently.
  2. What I learned reporting security issues to ten MCP vendorsFive kinds of problems, three human replies, one CVE, and the mistakes that changed how I write security reports.

How I report a problem

The same steps for a pull request or a private security report.

  1. Read the code against its own docs.I start from what the README, the security policy or the design notes say the code enforces, then look for where the code disagrees.
  2. Reproduce it more than one way.A direct call into the check, the same input under real shells in a sandbox, and the full program end to end where I can. Fake secrets only.
  3. Say what it shows, and what it doesn’t.Every report has a line for what I did not test. I also list what looked fine, and leave severity to the maintainers.
  4. Send the fix, not only the finding.Small patches in the project’s own style, with tests that fail before and pass after, and a check for false positives.
  5. Keep it private until they answer.I follow the project’s security policy and its timeline, with 90 days as my default. I say when I used an AI assistant.

The work around the feature

Delivery includes the less visible parts.

Make the slow path usable.

Database tuning, batching, and parallel processing cut a data workflow from roughly 12 hours to under 3.

Get payments through launch.

Provider verification, underwriting questions, checkout, webhooks, refunds, and settlement checks. The job went past making the API call succeed.

Stay with the system.

During an overnight security response, I reviewed logs, removed malicious files, rotated credentials, rebuilt the server, and restricted access. Remediation was completed within hours.

Experience

Most recent first. Some contracts overlap.

Jul – Sep 2026Cybersecurity SpecialistUS AI company · AI safety contract

Authored approximately 70 adversarial AI evaluation tasks and reference solutions covering prompt and tool injection, authorization boundaries, consent bypass, and unsafe tool execution. Reviewed generated code for vulnerabilities and documented reproducible failure cases.

Nov 2025 – Jul 2026Full-Stack Software EngineerConfidential fintech startup · Contract

Primary engineer across Node.js/TypeScript, Next.js, PostgreSQL, external APIs, deployments, and production support for a B2B platform serving German business clients. Built Stripe and Adyen payment and reconciliation workflows with webhooks, idempotency, retries, and tenant-scoped access. Worked directly with client teams to scope and troubleshoot integrations.

Aug 2025 – Jul 2026Software & Security Product EngineerUSK Group LLC · Gerfach

Built a TypeScript agent-security assessment CLI with 39 audit modules across seven protocol and tool families, including MCP, REST, GraphQL, and gRPC. Controlled tests in Docker, repeatable regression fixtures, and JSON/SARIF reports used for coordinated disclosure.

Read the case study
Jun 2023 – Nov 2025Contract Software EngineerIndependent consulting · US & Europe

Delivered applications, integrations, and data pipelines from requirements through deployment. Connected 30+ APIs and data providers across client projects and supported the systems after launch.

Jul 2022 – Apr 2023Technical Operations & Telemetry SupportU-Monitoring GPS · Kyiv, Ukraine

Supported vehicle and agricultural telemetry, an approximately 800 GB operational database, and services within a 20 TB server estate. Investigated failures and helped recover systems during power-related outages.

How I work

I built my first websites for paying clients at 16. Then I worked close to the infrastructure: telemetry, databases, and services that had to keep running. That background still shapes how I write software.

Today I work across product interfaces, backend systems, and AI-agent security. I’m comfortable discussing requirements with a client, making implementation decisions, and having those decisions challenged in review.

I prefer direct, two-way conversations: what you need, what I can own, and where the limits are. If something doesn’t fit, I would rather say so early.

I’m looking for work with real technical ownership, clear objectives, and a team that cares about what happens after release.

Product
TypeScript, React, Next.js, Node.js
Systems
Python, PostgreSQL, AWS, Docker, Linux
Security
MCP, AI-agent assessment, adversarial testing

For a role, a project, or a technical conversation.

Tell me what
you’re building.

Book a 30-minute conversation Prefer email? Write to me

A little context is enough: your product, the challenge, and where you need ownership.