Our Work
Some of what is below is ours: designed, built and operated by Cyberfu. Entries marked Experience are from my earlier career. I would rather show you working things than talk about theory.
Mocktail
The problem. People who sell API products have a demo problem. The buyer does not want a Postman collection; they want to see their own use case working, today, without a sales engineer on the call.
What we built. Paste your API payload and it becomes a form with sensible field types. Pick a browser or phone frame, brand it, and the demo plays live while you edit: the request updates line by line and the response types itself out, with realistic latency and both success and failure paths.
The name is the idea. All of the product experience, none of the backend: a Mocktail looks and feels like the real thing, with none of the risk. Every demo packs into a single link that carries the whole demo inside it, so nothing is stored on any server. v0.9 is deliberately single-user; workspaces and viewer analytics come next.
Native Sailfish OS apps
The context. Murat carries a Jolla Phone running Sailfish OS, a genuinely independent Linux phone. The platform has gaps, so we filled them with native apps, built to a standard other people can use.
- enteauth (v1.1): a two-factor authenticator for Ente Auth, with login, PIN lock and an end-to-end encrypted vault handled by a small C helper. The wire protocol was verified live against the real API before writing any app code.
- zaptecfish: control for a Zaptec home EV charger. Live charger state, start, stop and restart, and quiet re-authentication when the API's 24-hour token expires. The command maps were read from the vendor's live endpoint, not guessed from forum posts.
- sailddit (v0.2): a Reddit reader. Anonymous Reddit access in 2026 is effectively RSS-only, so it ships as an RSS-backed reader, with the hostile API surface documented along the way.
- octofish: Octopus Agile electricity rates on the phone. Colour-coded half-hourly prices for all 14 UK regions, with find-my-region by postcode, all over a public API that needs no key.
- osmfish: survey businesses into OpenStreetMap from the phone. Offline-first drafts in SQLite, then real OSM edits through the write API, attributed to your own OSM account.
- Netbirdfish: a client for NetBird, the open-source WireGuard mesh VPN. Peer list with live status, connect and disconnect, browser device login, and an exit-node picker. Works out of the box with the official NetBird cloud, or point it at any self-hosted server.
- Cloudfish (PCloud Client): a native pCloud client, in the spec phase. The pCloud API contract is documented method by method from upstream sources, with a live probe scripted and ready; no application code gets written until the probe confirms the contract.
- Merossfish: switches Meross smart bulbs on and off over the home LAN. A one-time cloud sign-in fetches the account's device key; after that, control is entirely local, with bulb discovery by network scan and voice control through the phone's assistant.
- harbour-ntfy: a client for ntfy, the self-hostable push notification service. Subscribe to a topic, get native notifications, and anything missed while the app was closed is caught up on launch.
- harbour-chameleon: drives a Chameleon Mini RevG, an RFID research tool, from the phone over USB-OTG, so no laptop is needed in the field. Tested against the community "RevE rebooted" firmware.
- sailfish-prayertimes: prayer times on the phone, straight from our own prayertimes.tr API. The same official Diyanet data as the website, in your pocket.
- swipe-keyboard: swipe-to-type for the stock keyboard. It keeps the Jolla keyboard's look and tap behaviour and adds gesture typing with a visual trail and an alternates bar; the decoder is original, built and verified against the real keyboard on the phone.
Why this matters to you. One habit runs through all of them: check how the thing actually behaves before trusting it. That is exactly how your vendor integrations get treated.
Volts or Dino Juice
The problem. The electric versus petrol argument is usually settled with slogans. What a driver actually wants to know is what each car would cost per mile, on the prices they pay.
What we built. Put in what you pay for fuel and electricity, and the site works out what each car really costs per mile, with a five-year cost chart and a break-even marker once purchase prices are added. It is built for UK drivers first, in pence per litre and pence per kWh, and a region switcher for the US and EU converts currency and units properly in both directions.
Why this matters to you. The maths runs in your browser on your own numbers, the chart is hand-rolled SVG instead of a chart library, and there is no analytics. A small tool, finished properly and self-hosted, is the same standard we bring to client work.
Conch
The problem. Asking your computer for something usually means a browser, a login and typing. At a desk, voice should be quicker: hold a button, ask out loud, and get an answer you can keep as text.
What we built. Conch is a voice-first assistant for our own Linux machine. Hold the shell to talk: sessions run down the left, a push-to-talk orb sits in the middle, and replies are spoken aloud while anything carrying code or structure appears as a card. Pressing the orb mid-answer interrupts and takes the floor. Speech recognition and synthesis run locally, and the assistant can run terminal commands as tools.
Why this matters to you. The voice never leaves the machine, the engines were chosen by measurement rather than marketing, and it is built for daily use on real hardware. Verifying before trusting is the habit behind everything on this page.
ArchiveGaza.org
What it is. A public-interest website archiving Palestinian culture and the documented historical record: 43 culture entries covering food, tatreez, music, poetry, celebrations, places and language, a sourced 63-event timeline running from 3300 BCE to August 2026, a historical map gallery with an interactive map, and a 13-case claims-and-evidence ledger.
How it was built. It is Murat's passion project for his wife, Lara, put together with agent-assisted research: three research passes over the timeline, the misinformation ledger and freely-licensed culture media, with every claim source-verified and retractions linked. Site text is CC BY-SA 4.0, and an Arabic edition led by Lara is planned next.
Why it is evidence. It is the evidence-first method Cyberfu sells, applied to a content-heavy site: content modelling, media licensing discipline and maps, end to end on an Astro stack. Humanitarian value is the point; revenue is not a purpose.
prayertimes.tr
The problem. Turkey's prayer times are published officially by Diyanet, but the data is awkward to consume and most existing sites bury the answer in adverts.
What we built. A Go API over the official data with an Astro front end, covering all 81 provinces and 869 towns, running on infrastructure we pay for and look after. A freemium tier with self-service signup is on the way.
Why this matters to you. It is our own product, at our own cost and risk. The same care we put into it is what you get on your project: take an official or vendor data source, wrap it in a clean API, and keep it running.
Payments APIs at Orbital
The work. Building against Orbital's payment products: hosted payment page deposits, rapid deposits, an embedded payment page, and API-driven invoicing.
The demo. The public result is getorbitaldemo.cyberfu.co.uk: a working demo application created so clients could understand how the product and its API work in something much closer to real life than a documentation page. Each flow can be walked end to end, with realistic requests, responses and payment states.
What it demonstrates. Taking a payments API and making it tangible: authentication, the happy path, the failure path, and a presentation that lets a non-technical stakeholder watch what is happening to their money at every step.
Payment orchestration at Checkout.com
The work. Murat worked on ProcessOut, Checkout.com's payment orchestration product: many payment providers behind one clean API, so merchants never rebuild their checkout to add or switch acquirers. He led technical implementations for global merchants and managed the full lifecycle, acting as technical consultant and advisor on REST API integrations and complex payment architectures.
The details. When implementations hit trouble, he investigated and resolved the blockers by analysing backend logs and gateway responses, and owned post-implementation support and incident resolution afterwards, with deep troubleshooting and root-cause analysis. He bridged the gap between technical and business stakeholders with clear documentation and architectural walkthroughs to reduce integration friction, and partnered with Product and Engineering to turn merchant feedback and integration trends into roadmap priorities and product improvements.
What it shows. Orchestration is integration work where the details really matter: idempotency, webhooks, failure modes, and money that has to reconcile. It is also merchant-facing work, and it taught him to make complicated integration stories simple. That experience sits behind the way Cyberfu handles a client's payment integrations today.
WhatsApp Payments at Facebook
The work. Murat was a Product Operations Analyst on WhatsApp payments, working across the UK, EU and India markets. He did product development for P2P payments, ran UX research and beta testing for products still in development across Payments, Oculus (Quest) and Meta Portal, and managed partnerships with several banks as integration partners, collaborating with NPCI, the Indian governing body, to ensure 100% local legal compliance.
The scale. The India P2P UPI product launched to 500 million users. To run operations locally, Murat established a Product Operations presence in India, hiring and training four analysts to take over the project, which cut partner query turnaround time by 30%. When Facebook consolidated its payments projects, he handed the UK/EU product over to Facebook Pay Engineering.
What it shows. Payments across three regulatory regimes, from research to launch to handover, and a team built and left behind cleanly. That is the depth behind the integrations Cyberfu builds today.
Google Pay at Google
The work. Murat was a Solutions Engineer on Google Pay, serving as a technical implementation consultant for banks and financial institutions across EMEA as they onboarded to the platform. He conducted API implementation reviews, bug triaging and regression testing, so that not one launch-blocking issue reached an integrated partner, and provided consultation and accreditation to mobile OEMs to ensure adherence to Google's behaviour and standards.
The results. Working with Business Development, he upsold features such as flight tickets and Membership Passes, achieving 90% of the annual new business target. He led an optimisation project with Samsung to enhance NFC performance for mid-range Galaxy devices, reducing customer service inquiries by 10%, and acted as the SME contact for the Google I/O and Liverpool Stadium ticketing integrations, increasing client adoption by 15%.
What it shows. The same payments work from the other side of the table: helping banks and device makers implement the stack properly, and being accountable when it launches.