|
An AI engine that turns a raw Windows disk image into a scored forensic timeline, with a predicted MITRE ATT&CK tactic for every activity session and a full HTML/PDF report. Graduation project: 99/100, and first place in an iZone competition for best graduation project. 12 artifact parsers · 75-feature behavioral vectors · benign + 11 tactic classes
|
The Signal Protocol in TypeScript, so any Node.js or NestJS backend can add end-to-end encryption without changing its transport or database. X3DH · Double Ratchet · Sender Keys · multi-device sessions · safety numbers 92 tests, including RFC 7748/8032/5869 and Google Wycheproof vectors. Not yet independently audited. |
|
A multi-tenant SaaS shipped end to end: four-role permissions, Stripe billing with verified webhooks, and two API and two SPA instances behind an nginx load balancer.
|
Labeled attack data barely exists, so I built a factory for it. Persona-driven agents operate real VMs and produce benign and attack artifacts with ground truth. 255 action classes across Windows and Linux · 5 personas · 37 scenarios
|
Security is what ties my work together, from the client down to the disk image.
| Where | What I built |
|---|---|
| Libraries | signal-protocol-node: end-to-end encryption for Node.js, tested against RFC and Wycheproof vectors, including replay and tamper rejection |
| Backend | Rotating refresh tokens stored as SHA-256 hashes, with reuse detection that revokes every session. Tenant-scoped roles, audit logs and signature-verified Stripe webhooks |
| AI | An intrusion prevention model that feeds Suricata in real time, and anomaly scoring that maps activity to MITRE ATT&CK tactics |
| Forensics | Disk images sealed with SHA-256 and a manifest of every stage, from acquisition to the final PDF |
| Layer | What I work with |
|---|---|
| Web | React 19 and TypeScript SPAs with Redux Toolkit, TanStack Query, Tailwind and Zod. Budget Planner is a good example |
| Mobile | React Native with Expo and Expo Router |
| Backend | Laravel and NestJS APIs, multi-tenant SaaS, MySQL |
| ERP | ERPNext |
| Delivery | Docker, nginx load balancing, GitHub Actions |
I ran my own career through my forensics engine. It flagged a pattern.
Open the evidence locker
| Project | What it is |
|---|---|
| SPH Fluid Wind Tunnel | 5,000-particle fluid simulation with all the physics in HLSL compute shaders |
| nestjs-crud-base | Published npm package: a config-driven CRUD factory for NestJS and TypeORM |
| BashDB | A database management system in pure Bash, where directories are the storage engine |
| Train 3D | A walkable 10-car train in C++ and classic OpenGL, with no engine |
| Basket Goal | A sliding puzzle that solves itself five ways, from BFS to A* |
| torlize-proxy | A small, educational SOCKS4/4a client in C |
| Notebook | Result |
|---|---|
| London House Price Prediction | Ranked 40th in the Kaggle competition |
| IPS Model: NFUQ NIDS v2 | 95% accuracy, with real-time Suricata integration |
| Arabic Punctuation Prediction | Rare-class F1 raised from 0.60 to 0.70 with a BiLSTM-CRF |
| Vehicle Sale Data Regression | R² of 0.85 on the test set |
More on Kaggle.
- Working as: a full-stack engineer
- Building: a reusable auth library
- Learning: LLM evaluation and agentic pipelines
- Reading: Designing Data-Intensive Applications
Not looking for a new role, but always happy to talk shop.
My portfolio has a working terminal and five hidden easter eggs. Try sudo rm -rf /.