Secure Engineering Projects
A collection of full-stack applications and security work. Focusing on the engineering and defense aspects of each project.
AI-powered platform to build and orchestrate autonomous AI agent workflows.
Orchestrating autonomous AI agents requires maintaining state across distributed nodes while ensuring secure, isolated execution environments. Existing tools were either too rigid (no code) or lacked proper observability for agent hallucinations and failures.
Developed a highly interactive UI with visual node-based workflow builder, real-time logging, and agent memory management.
Enabled users to seamlessly create, deploy, and monitor AI agent workflows with full observability.
A fast, client-side PDF processing suite for editing, merging, and converting PDF documents.
Many online PDF tools compromise privacy by uploading sensitive documents (like tax returns or legal contracts) to external servers for processing. This creates a massive data exfiltration risk.
Built a privacy-first web application utilizing WebAssembly and client-side JavaScript to perform all PDF operations locally in the browser.
Delivered a secure, offline-capable PDF suite that ensures zero data leaves the user's device.
Interactive product demo creation platform for SaaS companies.
Creating engaging product demonstrations requires significant engineering resources to build custom sandboxes, or forces users to watch non-interactive video recordings.
Engineered a platform that captures DOM states to generate highly interactive, clickable product walkthroughs without writing code.
Allowed marketing and sales teams to create self-serve, interactive product demos in minutes, boosting engagement.
All-in-one product launch and marketing automation platform for creators.
Founders struggle to coordinate multiple fragmented marketing channels (Mailchimp, Google Analytics, Typeform) during critical product launches, leading to lost leads and poor conversion visibility.
Integrated waitlist management, email automation, and conversion tracking into a single dashboard using modern web technologies.
Streamlined the launch process, improving lead capture rates and providing actionable insights for successful product releases.
AI-powered third-party vendor risk monitoring prototype with real-time risk scoring.
Organizations struggle to monitor vendor risks in real-time, often relying on manual periodic surveys that fail to capture immediate threat posture changes.
Implemented RBAC for Admin/Vendor views, APScheduler-driven dynamic scoring engine, and compliance audit log. Designed a live glassmorphism dashboard with Chart.js visualizations.
Delivered a dynamic risk score monitoring dashboard with continuous vendor risk visibility, backed by FastAPI, SQLAlchemy, and Firebase.
Zero-trust security layer and real-time monitoring gateway built for multi-agent AI ecosystems.
As AI agents transition to taking autonomous, real-world actions, they become vulnerable to adversarial command hijacking, privilege escalation, and data exfiltration from compromised internal components.
Designed a zero-trust scoring engine with keyword analyzers and payload inspection. Built a highly responsive Next.js dashboard with Recharts telemetry visualizing threat vectors in real-time.
Achieved sub-12ms mitigation gateway latency with customizable threshold blocking (ALLOW / QUARANTINE / BLOCK) and immutable action audit logging.
Intelligent customer onboarding portal and automated qualification system engineered for State Bank of India.
Traditional banking onboarding systems are slow and complex, often lacking conversational support, leading to high drop-off rates and insecure KYC validation.
Developed a Vite + React + TypeScript interface. Integrated Gemini LLM for product matching, qualification agents for suitability scoring, and a Compliance Agent for real-time conversation safety monitoring.
Successfully implemented dynamic e-KYC (Aadhaar & OTP simulation) and low-latency product matching, with interactive live log traces of agent orchestration.
Addressed lack of real-time visibility into network attacks faced by SOC teams handling high-volume logs.
Network security teams lack real-time visibility into complex attack vectors, overwhelmed by raw logs without actionable insights or ML context.
Developed a real-time intrusion detection system with ML-based anomaly detection and live SOC dashboards. Implemented XGBoost models with WebSocket streaming to detect DDoS, SQL injection, and brute-force attacks.
Integrated high-volume network log ingestion pipeline to provide continuous visibility for SOC analysts, delivering sub-10ms inference latency.
Automated phishing detection system for email and URL analysis targeting enterprise spam filter gaps.
High-velocity phishing attacks bypassing traditional spam filters, leading to credential theft and malware delivery within organizations.
Applied heuristic-based AI analysis with sandbox validation for real-time threat classification and alerting. Engineered URL reputation checks and header anomaly detection.
Reduced phishing exposure by proactive URL blocking and sandbox validation, protecting enterprise communication channels.
Production-style logistics system with secure authentication, RBAC, and real-time synchronization for food delivery operations.
Unauthorized access risks and data leakage across multi-tenant delivery operations.
Implemented secure auth flows, role-based dashboards, and encrypted data channels.
Prevented unauthorized access to operational data and streamlined delivery management.
Conducted deep-dive security research into Android application vulnerabilities, focusing on insecure data persistence and network communication flaws.
Sensitive JWT tokens were stored in plain-text shared preferences, and lack of SSL pinning allowed for easy MITM interception of encrypted traffic.
Performed static analysis with JADX/MobSF. Utilized Frida for dynamic runtime hooking to bypass SSL pinning and inspect binary data structures.
Secured local storage using the Android Keystore system and implemented robust certificate pinning, eliminating local data theft vectors.
Conducted structured security assessments to identify data exposure, authorization flaws, and access control weaknesses.
Exposed API endpoints allowed Insecure Object Reference (IDOR) and weak session management, risking unauthorized multi-tenant data access.
Manual intercept testing with Burp Suite for broken access control and session hijacks. Automated baseline scans with OWASP ZAP.
Eliminated IDOR risks and stored XSS flaws by enforcing strict RBAC and server-side input validation across the API layer.