Core
Designed the NestJS orchestration core: scan lifecycle, crawler, BullMQ processor, audit log, JWT-guarded scan and report routes, Socket.IO streaming, and HTML/JSON/PDF report generation over PostgreSQL.
options.auth → POST /login (target site)Optional login to the target application so protected pages can be scanned. Deliberately separate from the credentials used to call RedSentinel's own API — scanning a logged-in surface must never widen access to the scanner.
discover: urls · query params · forms · DOM sinks · WAFThe core walks the target and records every place user input can land, including DOM sinks the server never sees. WAF fingerprinting happens here, because knowing what filters the traffic changes which payloads are worth generating at all.
POST :5001/analyze → reflection context + allowed charsThe context module probes each reflection location and reports the context it landed in and which characters survived the round trip. This is where the DistilBERT classifier runs. A reflection inside an attribute value and one inside a script string need entirely different payloads — getting this wrong wastes the whole budget downstream.
POST :5002/generate → select · mutate · obfuscate · rankPayloads are selected against the reported context, mutated and obfuscated, then ranked. XGBoost ranking runs only when the ranker artifact is actually mounted; without it the service falls back to heuristic ranking rather than failing the scan. The payload bank comes from the curated dataset split — an empty bank returns 503 instead of silently scanning with nothing.
POST :5003/fuzz → reflect? → execute in headless browser?Each ranked payload is fired, checked for reflection, and — when verification is on — actually executed in a headless browser before it counts. That last step is why the strict evaluation reports zero false positives: a page that reflects input but never executes it produces no finding.
score → persist → dedupe → html | json | pdfFindings are scored with a rule-based severity model, persisted to PostgreSQL, deduplicated, and rendered. The dashboard follows all of this live over Socket.IO instead of polling, and every state change lands in a per-scan audit log.
The real pipeline, as implemented. Read the case study →
B.E. Computer Engineering, Tribhuvan University, 2026. I work across Python ML pipelines and TypeScript backends, and I ship both halves myself — from the training loop to the queue that serves it.
Flagship
AI-assisted XSS vulnerability scanner. Capstone project, team of three. I was lead architect: I owned the NestJS orchestration core and the entire ML pipeline; my teammates built the fuzzer and obfuscation engines.
Designed the NestJS orchestration core: scan lifecycle, crawler, BullMQ processor, audit log, JWT-guarded scan and report routes, Socket.IO streaming, and HTML/JSON/PDF report generation over PostgreSQL.
Fine-tuned a DistilBERT multi-task head that labels a reflection's context and severity, replacing signature matching. It sits inside the context module and decides which payload family is worth generating at all.
Curated the payload bank to 59,122 entries from AwesomeXSS, PayloadsAllTheThings, XSSGAI and PortSwigger material, with a reproducible manifest carrying SHA-256 checksums and row counts, plus a twelve-section statistics report.
Co-developed an XGBoost payload ranker over 35 engineered features. It runs only when the ranker artifact is mounted; otherwise the service degrades to heuristic ranking instead of failing the scan.
From the 47-endpoint evaluation in eval/, under browser-execution strict counting — a finding only counts if the payload executes in a headless browser. Cross-tool runs against ZAP, XSStrike and Dalfox use reflection-based counting and read differently; the classifier’s own accuracy is a separate, more sobering number. All of it, with the caveats →
Also shipped
SaaS · FastAPI, React, Fly.io
PDF or EPUB in, audiobook out. Chapters are detected on upload, read in an e-reader view, converted server-side, and played back or downloaded as MP3.
A React SPA on Cloudflare Pages talks to a FastAPI service on Fly backed by SQLite in WAL mode; a separate TTS worker fleet runs kokoro-onnx. The worker never touches the database — it claims and completes jobs through internal endpoints over Fly's private network, so SQLite keeps exactly one writer. Quota is transactional: the free tier's three lifetime conversions are checked and incremented inside one transaction, and refunded when a job permanently fails. The queue is crash-safe — jobs running past 15 minutes are requeued, three failed attempts mark the job failed with a user-visible reason and a retry. Synthesis sits behind a single synthesize() interface, so a premium voice provider drops in as a higher tier without touching the queue. Magic-link and Google auth, Stripe webhooks for billing.
Platform · Fastify, Prisma, Flutter
A calm, adaptive workspace for neurodivergent users — built as general wellness and assistive productivity, explicitly not as a diagnostic tool.
Fastify and TypeScript over Prisma, PostgreSQL and Redis, with Zod at every boundary; the client is Flutter with Riverpod, GoRouter and flutter_tts. The AI layer is provider-abstracted across OpenAI and Anthropic and runs a hybrid rules-plus-LLM path with output validators, so a model swap doesn't change behaviour. Five MVP modules: a microtask engine that splits a goal into 3–12 atomic steps, reading support with an original/simplified toggle and line focus, timed focus sessions, an explicitly user-controlled preference profile that never infers a diagnosis, and first-party analytics the user can export and hard-delete. Docker Compose, GitHub Actions, nginx with Let's Encrypt, Prometheus.
SaaS · Fastify, React Three Fiber
Birthday SaaS — a 3D greeting experience on the front end with a typed, validated API behind it.
Split across two repos. The web app is React with React Three Fiber and drei for the 3D scene, Zustand for local state, TanStack Query for server state, and Framer Motion for transitions. The API is Fastify with JWT in httpOnly cookies, bcrypt for credentials, Zod schemas on every route, and PostgreSQL over node-postgres.
Hackathon · Express, Flutter
Event coordination for OSM Hackfest: REST APIs for event tracking with GPS-based attendance validation, and a Flutter client for attendees.
Attendance is validated server-side against the event's coordinates rather than trusted from the device, so a check-in is only accepted inside the event's radius during its window. Express handles the REST surface; the Flutter app covers event discovery, check-in and tracking.
Web app · Flask, MongoDB
CV builder — drag-and-drop editing, multiple templates, live preview, and PDF export.
Flask API over MongoDB Atlas with authentication and per-user profiles; the editor renders a live preview as you type and exports through jsPDF client-side, so document generation never blocks a request. Responsive down to phone widths.
Tool · React, GitHub Actions
Converts Markdown in the browser and exports to PDF, DOC, HTML, MD or plain text. No upload, no server.
Conversion runs entirely client-side, so documents never leave the browser. CI is the interesting half: every push to main runs lint and build, publishes dist to the gh-pages branch only when the build passes, and pull requests run the same checks without deploying.
Around seventy public repositories in total — labs, language experiments, and the things that turned into the above. Browse them on GitHub ↗
Track record
Contract · Remote
Delivered production platforms on an Express.js and React stack — authentication, REST APIs, and third-party integrations, taken from spec to live site.
Program
Coached students on building scalable applications: clean backend architecture, separation of concerns, and the development practices that survive a second contributor.
Tribhuvan University · 2022–2026
Institute of Engineering, Pashchimanchal Campus. Graduated 2026; RedSentinel was the capstone.
Day to day