I study cyber security at Air University in Karachi. Most of what I know about building software comes from hackathons and two internships. When a model's output decides something in one of my projects, a check in code has the final say: a rules engine, a person's approval or a certificate the model can't fake.
| Project | What it is | Where it came from |
|---|---|---|
| VeriVoice | Fact-checks health and climate rumours sent as voice notes and answers aloud in four languages, as a web app and a Discord bot. 195 tests. | UNESCO Youth Hackathon 2026. I led a team of six. |
| LifecycleZero | Console that flags risky local AI processes from signed endpoint telemetry and isolates a host in one DynamoDB transaction. Live | H0: Hack the Zero Stack (Vercel v0 and AWS Databases) |
| OmniFlow AI | Venue-operations agent that pulls context through MCP from MongoDB, Elasticsearch and GitLab and asks Gemini for a reroute plan. | Google Cloud Rapid Agent Hackathon |
| FlyRank capstone | Ranks 30,000 URLs by content decay. Random Forest: 0.70 Precision@50 against 0.40 for the hand-written rule on unseen clients. Paper | ML internship at FlyRank AI |
| Aegis-QA | Drafts a PyTest suite and a security review for pasted Python code with IBM Granite on watsonx.ai. | IBM Bob Hackathon, May 2026 |
| The Last Signal | Browser survival-horror game with an enemy that hunts you by sight and sound using A* pathfinding. Play | Personal project |
| Local-first LLM agent | Batch agent that runs a 4-bit Qwen 2.5 3B on 2 CPUs and 4 GB of RAM, and calls a hosted model only when an answer fails its check. | AMD Developer Hackathon 2026, team entry |
| Asal ya Nakli | Checks medicine names against sample DRAP and WHO lists in the browser. Live | GDG Live Pakistan, Chai & Code. Built in 120 minutes. |
Community Manager Intern, lablab.ai (Aug 2026 to now). I moderate the Discord during hackathons, help teams while they build and write the weekly AI recap and the success-stories series.
ML Engineering Intern, FlyRank AI (Jun to Sep 2026). I found that a random train/test split let the model memorize clients, so I split by client instead. The ranked refresh queue shipped with a reason code for every page.
BS Cyber Security, Air University, Karachi (2026 to 2029). Blue Team member at the AU Cybersecurity Society.
- BerriAI/litellm #47733: token counting for tool-call blocks in the middle of a conversation (in review)
- BerriAI/litellm #47858: enforce access groups in authorization checks (in review)
- elizaOS/eliza: 7 bug fixes with regression tests for Discord reactions, attachments and reply ordering. Reviewers approved them, then upstream shipped its own fixes.
Python, TypeScript, Go and SQL. LangGraph, the Model Context Protocol, the Gemini API and local models through llama.cpp. Next.js, React, Node.js, FastAPI, DynamoDB and MongoDB. Docker, Google Cloud Run, AWS (SQS, ECS), Vercel and GitHub Actions. For security work: mutual TLS with SPIFFE-style identity, HMAC request signing, the OWASP Top 10 and Semgrep.
