$ whoami

Hey! I'm Kaloyan Stefanov

I'm studying for a BSc in Network Technologies at New Bulgarian University, after five years training as a network technician and completing Cisco CCNA 1–3. On the side I study cosmology, and it finds its way into my code: SatStreak names the satellites crossing your night-sky photos. In between, I build things people actually use, most recently a vulnerability scanner during my internship at Sirma Academy.

GitHub | LinkedIn | TryHackMe | CV | Get in touch

About

cat ~/README.md

I like tools that do one job properly. The one I'm proudest of is the vulnerability scanner I built at Sirma Academy, which ranks leaked credentials and vulnerable dependencies by what attackers are actually exploiting, not just by how bad a bug could be. I've also shipped a guitar-tab transcriber on PyPI, an AI search engine for Bulgarian tradespeople, and a live site for a real client. Seeing someone use a thing I made, and then use it again, is what keeps me building.

Featured Projects

View all
kaloyan@sirma: ~/targetv0.4.0
6 finding(s): 1 critical, 4 high, 1 low
[!] 1 actively exploited (CISA KEV)
[>] Patch first: GHSA-4qwp-7c67-jmcc

SEVERITY CVSS   EPSS KEV  RULE
CRITICAL  9.8  99.9% YES  GHSA-4qwp-7c67-jmcc
HIGH      7.5   3.9%   -  GHSA-562c-5r94-xh97
HIGH      --      -    -  aws-access-key .env:3

Vulnerability Scanner

Sirma internship · team of 2

Point it at a codebase and it reports what could get it breached: leaked credentials and vulnerable dependencies across 12 ecosystems. Findings are ranked by real-world exploitation (CISA KEV, EPSS), not CVSS alone. I built the dependency engine, the CLI and the React web UI.

▲ Six-repo batch scan cut from 25.4s to 8.7s by running each scan in its own process.

  • python
  • fastapi
  • react
  • sarif
  • github-actions
source
kaloyan@sofia: ~/musicpy 3.10+
Transcribing riff.wav ...
Engine: pyin, 16 notes, ~99 BPM
Tuning: E2 A2 D3 G3 B3 E4 (standard)

e|---------------------------------|
B|-------------0---3---0-----------|
G|-----0---2---------------2---0---|
D|-2-------------------------------|
A|---------------------------------|
E|---------------------------------|

tabify

open source · PyPI

Turns guitar recordings, YouTube links and MIDI into tabs a guitarist would actually write. It scores every way to finger each note, then searches the whole piece for the path with the least hand movement.

▲ Install cut from 1.9 GB to 580 MB by running both models on ONNX instead of TensorFlow and PyTorch.

  • python
  • onnx
  • audio-ml
  • demucs
  • cli
pypi source
kaloyan@sofia: ~/skywsl
read from the photograph: exposure 20s, field 69°
(plate solved from 120 stars in 1.1s: alt 73.4 az 294.9)
(solved sensor roll: 359.2°)
Found 17 trail(s):
  1. STARLINK-35022 (NORAD 65409) - 89%
  3. ambiguous: FLOCK 4H-32 98%, EAGLET 2-5 81%
  5. FLOCK 4H-18 (NORAD 66721) - 100%
  ...

SatStreak

open source · CLI

Finds the satellite trails in a long-exposure night-sky photo and names each one by NORAD ID. It plate-solves the stars to work out where the camera was pointed, then matches the trails against real orbits.

▲ 100% precision on frames built from real orbits. When two satellites fit equally well, it says "ambiguous" instead of guessing.

  • python
  • astrometry
  • orbital-mechanics
  • computer-vision
source
mymaistor.comlive
MyMaistor home page: 'Tell us what needs doing', with a three-step explanation of how a search works

MyMaistor

product · live in Bulgaria

Describe a job in plain Bulgarian and it works out the trade, finds real businesses nearby from public data, and ranks them on evidence that they do that work. Then it drafts the enquiry for you to send. The AI never invents a business.

▲ Keeps working with no AI and no API keys, falling back to keyword search over its own OpenStreetMap index.

  • astro
  • cloudflare-workers
  • d1
  • gemini
  • search
mymaistor.com
metalmontaj.comlive
Metal Montaj home page: 'Wrought ironwork by hand', beside a photo of a forged fireplace set

Metal Montaj

client work · 2026

A Sofia metalwork workshop's site, taken from brief to launch. It's bilingual with no framework, and has a filterable gallery of 30 pieces with a keyboard-navigable viewer. Enquiries go straight to the owner's inbox from a Cloudflare Worker.

▲ Wrote the Bulgarian copy for his market and reworked the design based on his feedback.

  • vanilla-js
  • cloudflare
  • i18n
  • seo
  • gdpr
metalmontaj.com
apex · vercel.applive
APEX workout tracker landing screen: 'Track every set. Calisthenics and gym, one log.'

APEX

full-stack · PWA

A calisthenics and gym tracker I built front to back: a FastAPI and PostgreSQL backend with JWT and Google sign-in, plus personal records, a rest timer, an activity heatmap, progress charts and an AI coach that reads your training history.

▲ Six features shipped over 29 iterations. It installs on a phone like a native app.

  • fastapi
  • postgresql
  • oauth
  • pwa
live app source

Experience

tail -n 3 ~/career.log
  1. 2026.06 → 2026.09

    Software Engineering Intern @ Sirma Academy

    • Built 3 of the scanner's 4 components (scanning engine, CLI and web UI) covering 12 package ecosystems.
    • Agreed a shared Finding interface with the other intern up front, so our two halves merged into one tool without rework.
    • Set up CI/CD on GitHub Actions: tests on every push, the tool scanning its own code, and releases triggered by tags.
    • Picked up React on the job to ship the web interface next to the Python engine.
  2. 2025.09 → now

    BSc Network Technologies @ New Bulgarian University

  3. 2020 → 2025

    Network Technician @ Vocational School of Electronics "John Atanasoff"

    • Cisco CCNA levels 1–3 completed.

Dashboard / Highlights

Theme

Let's Connect

Open to junior roles, internships and interesting problems.

Email me

Currently Based In

Sofia, BG • --:--:--

Security

Top 15%

TryHackMe, 30 rooms completed

  • nmap
  • web-enum
  • idor
  • auth-bypass
tryhackme.com/p/kelion

Recent Commits [cached]

  • tabifyStretch fast playing before the model hears it
  • SatStreakSelect stars by peak and compactness, not by summed flux
  • SatStreakGive the library solver a timeout it cannot evade
    View on GitHub

    Off the Clock

    Guitar, and producing in Ableton Live. That's why I built tabify. Here's a riff it transcribed, played back in your browser:

    99 BPM · standard tuning · synthesised string

    stack.yml

    lang:     python, javascript, c++, sql
backend:  fastapi, node, express
frontend: react, vite, html/css
data:     postgres, sqlalchemy, mongo
infra:    cloudflare, gh-actions, linux
net:      cisco-ios, nmap, metasploit
spoken:   bulgarian, english # C1

    $ ./connect --now

    Let's build something.

    If you're hiring, have a problem worth solving, or just want to talk tools, my inbox is open.

    kaloyanstefanov6@gmail.com
    github linkedin tryhackme cv.pdf