Client website
Tropico
A focused digital storefront for a Sri Lankan natural-food brand, making its product range easy to understand and simple to purchase.
- Nuxt
- Vue
- Product catalogue
- Daraz commerce
Available for selected projects
Web development & security, carefully delivered.
I’m Ashen, a full-stack and security engineer in Sri Lanka. I build websites and web applications, then help businesses find and fix weaknesses through application security reviews and offensive testing.
Selected work
Useful products, carefully delivered.
Client work sits alongside products and research that show how I think through real technical problems.
02 
Security product
Phisher
A dual-architecture phishing detection system spanning a browser extension, web application, machine-learning API, and published IEEE research.
03Publishing platform
Personal Blog
A fast, accessible reading experience for technical writing, with search, categories, RSS, and a custom typography system.
04Product engineering
Leaflet
A local-first Markdown workspace that combines rich note-taking with purpose-built tools for pentest and CTF engagements.
How I can help
Focused services. No agency hand-offs.
Whether you need something built or tested, you work directly with the engineer doing the work, so context does not get lost between meetings.
Business websites
Clear, responsive websites that explain your value, earn trust, and give visitors a direct next step.
- Strategy and information architecture
- Responsive UI implementation
- SEO and analytics foundations
Web applications
Purpose-built tools and customer experiences shaped around the real workflow—not a generic template.
- Product and UX thinking
- Frontend and backend development
- Deployment and documentation
Application security
Focused reviews that uncover security weaknesses in an existing or planned application before they become expensive problems.
- Architecture and threat review
- Authentication and access-control review
- Clear, prioritised remediation guidance
Offensive security testing
Practical testing of web applications and APIs from an attacker’s perspective, followed by findings your team can act on.
- Web and API penetration testing
- Vulnerability assessment
- Evidence-led report and retesting
A clear process
Enough structure to stay aligned. Enough flexibility to do good work.
Every project is different, but the working relationship should always feel clear, collaborative, and calm.
- 01
Understand
We clarify the goal, current system, constraints, and what a useful result looks like.
- 02
Scope
I turn that context into a focused development plan or security testing scope.
- 03
Deliver
You see progress early, with short feedback loops and clear decisions along the way.
- 04
Handover
You receive the finished product or a clear security report with practical next steps.
Application & offensive security
Full stack engineer · Colombo, Sri Lanka
The person behind the work
Technical depth, business context, and a sharp eye for the details people notice.
My background spans full-stack product development, application security, and offensive security. That combination helps me build experiences that feel polished on the surface and hold up underneath.
I care about direct communication, maintainable decisions, and shipping work I’m happy to put my name on. For deeper technical projects and research, visit my main portfolio.
Start a project
Tell me what you need built or tested.
A few focused questions help me understand the work before our first conversation. It takes about two minutes.
Step 1 of 4
Project type