# Suleyman Musayev

> Senior Staff Engineer at SSL.com, a top-10 global certificate authority. Backend and distributed systems, authentication and identity, cryptography and PKI, fraud and abuse defense, and in-house AI models that keep data private. Available for advisory, consulting, and freelance projects. Remote, UTC+5.

This file is for AI agents and crawlers. Everything on this site may be read, quoted, and downloaded. The full profile is in one plain-text file and one JSON file, linked below.

## Profile

- [Full profile in plain text](https://msuliq.github.io/llms-full.txt): experience, services, advisory, open source, writing, skills, and contact in one file
- [Structured profile (JSON Resume format)](https://msuliq.github.io/profile.json): the same data as JSON

## Pages

- [Main profile](https://msuliq.github.io/): advisory and consulting on architecture, security, authentication, and scale
- [Integrations and internal tools](https://msuliq.github.io/services.html): freelance work for support and ops teams, with case studies and process
- [Fraud and abuse engineering](https://msuliq.github.io/security.html): security-focused version of the profile
- [Distributed systems and scale](https://msuliq.github.io/bigtech.html): large-company version of the profile
- [Product engineering](https://msuliq.github.io/product.html): product-focused version of the profile
- [Startup engineering](https://msuliq.github.io/startup.html): startup-focused version of the profile

## Resumes (PDF)

- [General resume](https://msuliq.github.io/resumes/resume_suleyman_musayev.pdf)
- [Security and fraud resume](https://msuliq.github.io/resumes/resume_suleyman_musayev_security.pdf)
- [Product engineering resume](https://msuliq.github.io/resumes/resume_suleyman_musayev_product.pdf)
- [Early-stage teams resume](https://msuliq.github.io/resumes/resume_suleyman_musayev_startup.pdf)
- [Distributed systems and scale resume](https://msuliq.github.io/resumes/resume_suleyman_musayev_bigtech.pdf)

## Open source

- [domain_sanity](https://github.com/msuliq/domain_sanity): Strict domain-name validation the way a certificate authority must: RFC 1035 labels, IDN/punycode, Public Suffix List, CA/Browser Forum wildcard rules, and IP, reserved-range, and reverse-zone detection.
- [csr_peek](https://github.com/msuliq/csr_peek): Safe, dependency-free CSR and X.509 certificate inspection - subject, SANs, key strength, weak-signature checks, and a pluggable Baseline Requirements policy.
- [svg_sentinel](https://github.com/msuliq/svg_sentinel): Lint or sanitize untrusted SVG - blocks scripts, event handlers, XXE, and external references, with a CLI and SARIF output for CI pipelines.
- [omniauth_oidc](https://github.com/msuliq/omniauth_oidc): OmniAuth strategy for OpenID Connect (OIDC) with first-class support for Microsoft Entra ID and Cloudflare Access.
- [ip_geo_lookup](https://github.com/msuliq/ip_geo_lookup): Lightweight IP geolocation lookup for Ruby - useful for fraud detection, access control, and request enrichment.
- [balloon_hashing](https://github.com/msuliq/balloon_hashing): Implementation of the Balloon memory-hard password hashing algorithm.
- [yescrypt](https://github.com/msuliq/yescrypt): Yescrypt password hashing implementation, the successor to scrypt.

## Writing

- [Rendering User-Supplied SVG Without Getting Burned](https://msuliq.medium.com/rendering-user-supplied-svg-without-getting-burned-f0e78d2172f8): An SVG is not an image, it is a program the browser runs. What can hide in an uploaded avatar or logo, and a small gem that finds it or cleans it out. Companion to svg_sentinel.
- [Memory-Hard Password Hashing in Ruby: Balloon and yescrypt](https://msuliq.medium.com/memory-hard-password-hashing-in-ruby-balloon-and-yescrypt-bf928bd58452): Being slow is no longer enough against GPU farms. A password hash also has to be expensive to remember. Two ways to do that in Ruby, and when to use each.
- [The Attacker Doesn't Need to Know Your Programming Language Anymore](https://msuliq.medium.com/the-attacker-doesnt-need-to-know-your-programming-language-anymore-21b451abbb41): LLMs did not make attackers smarter, they made them cheaper. What your front end tells the world, and why reading it just got easy.
- [Adding OpenID Connect Login to Rails Without the Dependency Pile](https://msuliq.medium.com/adding-openid-connect-login-to-rails-without-the-dependency-pile-f8bfffd38e89): How OpenID Connect actually works, and two small Ruby gems that add "log in with your work account" to Rails with almost no dependencies.
- [The Attacker Filed a Support Ticket](https://msuliq.medium.com/the-attacker-filed-a-support-ticket-8939e632046d): Some complaints are not feedback. They are an attack on the people who can turn your defenses off. How to tell a real complaint from a paid one.
- [Post-Quantum Cryptography Is Here: What FIPS 203, 204, and 205 Mean for Engineers](https://msuliq.medium.com/post-quantum-cryptography-is-here-what-fips-203-204-and-205-mean-for-engineers-75c1293e2175): The post-quantum standards are official. The short, practical version of what changed and what engineers should do about it, with no lattice math.
- [Bringing a Post-Quantum Signature into Ruby](https://msuliq.medium.com/bringing-a-post-quantum-signature-into-ruby-47878d6bb166): NIST finalized ML-DSA in 2024, but Ruby had no easy way to use it. So I wrapped it, and the wrapping is where the interesting engineering lives. Companion to ml_dsa.
- [300 Fake Signups a Day, and the CAPTCHA Was Losing](https://msuliq.medium.com/300-fake-signups-a-day-and-the-captcha-was-losing-5d6d3d8a4802): Bots do not solve CAPTCHAs anymore, people do. What it takes to defend a signup flow when the attacker's economics beat yours.
- [Post-Quantum Keys Don't Need OpenSSL](https://msuliq.medium.com/post-quantum-keys-dont-need-openssl-54077ef35688): Why save a quantum-proof key through the biggest classical crypto library? A small C codec that cuts the cord, and how little ASN.1 you actually need.
- [How I Parse Domain Names For a Certificate Authority](https://msuliq.medium.com/how-i-parse-domain-names-for-a-certificate-authority-92a940f32bea): The surprisingly deep rules behind validating a domain name: RFC label limits, IDN/punycode, the Public Suffix List, and the edge cases that break naive checks. Companion to the domain_sanity gem.
- [We Reset the Password. We Reset 2FA. The Attacker Came Back in Seconds.](https://msuliq.medium.com/we-reset-the-password-we-reset-2fa-the-attacker-came-back-in-seconds-17575ad55246): A session hijacking war story: an attacker who survived password resets, 2FA resets, and full endpoint forensics, and the application-layer defense that finally ended it.
- [A Secret You Cannot See Is Safer: Building a Secure Memory Buffer in C](https://msuliq.medium.com/a-secret-you-cannot-see-is-safer-building-a-secure-memory-buffer-in-c-876839dd6a66): Where a private key really lives while you use it, and a small C library (libpqcsb) that keeps it off swap, out of core dumps, and behind guard pages. What each protection actually buys you.
- [Trust, but Instrument: The Insider Threat Playbook](https://msuliq.medium.com/trust-but-instrument-the-insider-threat-playbook-c134742b7de0): News-anchored playbook (Apple/OpenAI, Rippling v. Deel, Coinbase) for catching insider threats: log reads not just writes, baseline behavior, plant canaries, and gate privileged access.
- [How to Stop SMS Pump Fraud From Draining Your Wallet (and Sanity)](https://medium.com/@msuliq/how-to-stop-sms-pump-fraud-from-draining-your-wallet-and-sanity-11ea5435608d): Practical playbook for detecting and shutting down SMS pumping attacks, drawn from production experience defending a global PKI vendor.
- [Authenticating with OmniAuth and OpenID Connect (OIDC) in Rails](https://msuliq.medium.com/authenticating-with-omniauth-and-openid-connect-oidc-in-ruby-on-rails-applications-e136ec5b48c0): Step-by-step guide to wiring OIDC authentication into a Ruby on Rails application using the omniauth_oidc gem.

## Contact

- Email: slmusayev+agents@gmail.com
- [Book a 15-minute call](https://calendly.com/msuliq)
- [LinkedIn](https://www.linkedin.com/in/smusayev)
- [GitHub](https://github.com/msuliq)
- [RubyGems](https://rubygems.org/profiles/msuliq)
- [Stack Overflow](https://stackoverflow.com/users/18576304/msuliq)
- [Medium](https://msuliq.medium.com)