Ubaid-Ur-Rehman

Desktop energy-intelligence platform for Android engineers — runs 23 detectors over Java/Kotlin sources, builds a real cross-file call graph, and traces every finding back to the architectural decision that caused it. Built during the 48-hour IBM Bob 2.0 hackathon (Sep 2026).

Technologies: Android, Static Analysis, Energy Profiling, Call Graph, IBM Bob 2.0, Agentic Workflow, Developer Tools

• Reasons about cause, not symptoms: builds a genuine cross-file call graph and walks backwards from each finding to its lifecycle entry point, so a leaked wakelock in NetworkManager is reported as the symptom of a wakeup alarm registered in MainActivity that re-arms the path 96 times a day
• 23 energy detectors across wakefulness, network, location and lifecycle patterns — unclosed WakeLocks, postDelayed polling loops, sub-30-second GPS intervals, and JobInfo constraints written but never submitted
• Whole-repository reasoning with IBM Bob 2.0: Bob holds every file in a single pass, revises severities, corrects descriptions, and writes a fix against the specific traced chain — including defects the local pass attributes to the wrong method
• Self-verifying patch loop: Bob proposes a patch, EcoTrace re-runs its own detectors over it, and any patch that silences a rule by deleting the construct is rejected. Accepted changes land on a branch for human merge, never straight to main
• Measures real drain where devices are available: parses adb shell dumpsys batterystats snapshots and differences them into a drain rate in mAh/min attributed to the app under test rather than the whole device
• Honest provenance and zero-key operation: every figure reports whether it is measured, estimator-derived, or unknown, and all 23 detectors, call-graph chains, grading, history and reporting run offline, deterministically and free — Bob sharpens the analysis but is never a prerequisite
• Output is a self-contained HTML or PDF report that attaches to a ticket, plus an optional one-click patch that is authored, verified and branched for review

Privacy-hardened Debian 13 Linux distribution for Muslim families — KDE Plasma 6 and XFCE 4.20 live ISOs shipping the Sovereign Shield Islamic privacy stack: a local DNS filtering daemon with 326,632 rules, verified adult-content blocking, prayer-time Focus Mode, and a built-in 31-check self-test.

Technologies: Linux Distribution, Debian, Privacy, KDE Plasma, XFCE, Bash, Python

• Sovereign Shield: local filtering DNS daemon (127.0.0.1:53, 326,632 rules) with verified adult-content blocking (NXDOMAIN break-tests at build time), DNS-hijack prevention, and a self-verifying blocklist updater
• Faith workflow: astronomical madhab-aware prayer times with athan notifications, Hijri date, rotating Quran ayah notifications, Conky desktop widget, and reversible prayer-time Focus Mode
• Reproducible cloud builds: the full ISO pipeline (BIOS+UEFI hybrid, ~4.3/4.7 GB) runs on Kaggle notebooks with a QEMU QA harness and screenshot evidence
• Trust chain: hidayah-doctor 31-check self-test ships on the ISO (PASS 31 · FAIL 0), sha256 published, release artifacts GPG-signed

Trust-first social-commerce platform for Pakistan, built with React, Supabase, Cloudflare Pages, and Capacitor. It focuses on safer transactions, fast product discovery, and student needs.

Technologies: Startup, Marketplace, React, Supabase, Cloudflare, TypeScript

• Trust layer: masked chat, delivery-verification flow, and reputation signals
• Short-form Reel discovery feed with Cloudflare R2 media storage
• Student ecosystem: Study Graph, ISBN-based Book Exchange, and Student Alerts
• Security posture: RLS, Turnstile, HttpOnly admin cookies, TOTP 2FA, audit logs, and a stricter admin CSP

Free digital library for Pakistani students, built for 360 Muslim Experts. It brings textbooks, notes, past papers, and learning resources into a bilingual web experience with Telegram-based discovery; public usage metrics are not yet published.

Technologies: Education, Digital Library, Next.js, Cloudflare, TypeScript, Telegram Bot, Kaggle

• Next.js 16 + Cloudflare Pages + D1 + Workers KV + Internet Archive S3
• Telegram Bot with inline mode, fuzzy search, and a delete-my-data flow
• Kaggle operations with scheduled mirror and maintenance jobs
• Bilingual English/Urdu interface with RTL support, dark/light theme, PWA, and accessibility settings

Open source CLI security tool that detects unauthenticated and undocumented API routes via static analysis. Supports Express, FastAPI, Django, Flask, NestJS, Rails, and Spring Boot. Maps findings to OWASP API Top 10 with risk scoring.

Technologies: Security, Node.js, Static Analysis, OWASP, CLI

• Static analysis engine with multi-framework scanner support
• OWASP API Top 10 risk mapping with severity scoring
• Published on npm with active community usage
• GitHub Action integration for CI/CD pipelines
• Live dashboard at shadowaudit-dashboard.vercel.app

Islamic companion app — 395+ downloads on F-Droid. Nasheeds, Quran radio, Qibla, prayer times, 5 Android widgets.

Technologies: React, Capacitor, Android, F-Droid

• Privacy-first Islamic companion app with no tracking
• Published on F-Droid with 395+ downloads
• Nasheeds, Quran radio, Qibla, prayer times, 5 Android widgets

Privacy-first, Islamic-values-aligned, FOSS GPL-v3 on-device content-filtering Android app.

Technologies: Android, Kotlin, Privacy, Content Filter, GPL-v3

• On-device content filtering with Islamic values alignment
• GPL-v3 licensed, fully open source
• Kotlin + Jetpack Compose, Capacitor for Android

Transparent, open-source file encryption application featuring cryptographic security software.

Technologies: Encryption, Rust, Security, Cryptography, Privacy

• AES-256-GCM-SIV, a nonce-misuse-resistant AEAD, with per-file random nonces
• Rust implementation with zero dependencies
• Cross-platform: Linux, macOS, Windows

Simulation of a primitive AI agent with zero world knowledge.

Technologies: AI, Python, Reinforcement Learning, Simulation

• PPO + GRU based agent architecture
• Zero-shot learning simulation
• Python + PyTorch implementation

Offline-first mobile medical assistant for high-conflict and crisis zones like Gaza and Kashmir. Provides physician-validated emergency protocols without internet.

Technologies: Android, Kotlin, Medical, Offline, Crisis Response

• Offline-first medical assistant with no internet dependency
• Physician-validated emergency protocols for trauma, surgery, and first aid
• Designed for crisis zones with high-conflict environments

Lightweight Orbot alternative for low-end Android. Tor VPN, SOCKS5/HTTP proxy, obfs4 and snowflake bridges, kill switch.

Technologies: Android, Kotlin, Tor, VPN, Privacy, F-Droid

• Lightweight Tor VPN alternative optimized for low-end Android devices
• SOCKS5/HTTP proxy support with obfs4 and snowflake bridges
• F-Droid compliant, GPL-3.0 licensed

Self-hosted Android agent host with private Telegram control and embedded runtime.

Technologies: Android, Kotlin, Telegram, Self-hosted, Agent

• Self-hosted agent runtime for Android with private Telegram control
• Embedded runtime with no cloud dependency
• GPL-3.0 licensed with active development

Elite sovereign Command Centre for masculine discipline. Decentralized via Nostr with end-to-end NIP-44 encryption, featuring active Mindset Interventions and Biological Signal tracking.

Technologies: Android, Kotlin, Nostr, Privacy, Discipline

• Nostr decentralized architecture with NIP-44 end-to-end encryption
• Mindset Interventions and Biological Signal tracking
• No servers, no tracking — fully sovereign design

Android local-VPN DNS resolver manager with bounded DNS forwarding and resolver latency monitoring.

Technologies: Android, Kotlin, DNS, Privacy, DoH, DoT

• DNS-over-UDP, strict DNS-over-HTTPS, and strict DNS-over-TLS resolver support
• Per-resolver latency checks and automatic switching with cooldown and hysteresis
• Kotlin + Jetpack Compose with bounded packet handling and protected upstream sockets

High-performance Android DNS sinkhole with a large malicious, tracking, and adult-content domain database.

Technologies: Android, Kotlin, DNS, Privacy, Adblock

• 200,000+ domain blocklist covering malware, tracking, and adult content
• Jetpack Compose UI with Material Design 3
• Local-only processing with zero telemetry

9 vulnerabilities (3 Critical)

Discovered 9 vulnerabilities including 3 critical findings across EC-Council web assets. Acknowledged same day.

5 vulnerabilities (3 Critical PII leaks)

Identified 5 vulnerabilities including 3 critical PII exposure issues. Remediation confirmed within 72 hours.

6 vulnerabilities (XSS-to-ATO chain)

Found 6 vulnerabilities including a stored XSS-to-account-takeover chain via insecure session cookies.