{
  "basics": {
    "name": "Ubaid-Ur-Rehman",
    "label": "Full-Stack Engineer & Security Researcher",
    "email": "arifubaid0345@gmail.com",
    "url": "https://ubaid-ur-rehmanportfolio.vercel.app",
    "summary": "Full-stack engineer and security researcher, 2 years of shipped work. 20 disclosed vulnerabilities across 3 engagements, 12 F-Droid app audits, 3 patches merged upstream into Inkscape, Wireshark and gitlab-shell, and 15 products shipped — Android apps, web platforms, a Linux distribution and an npm CLI. Built with AI-assisted development and human review of every merge request.",
    "location": {
      "address": "Nazimabad, Karachi, Pakistan",
      "city": "Karachi",
      "country": "Pakistan",
      "countryCode": "PK"
    },
    "profiles": [
      {
        "network": "GitHub",
        "username": "theredhacker0345",
        "url": "https://github.com/theredhacker0345"
      },
      {
        "network": "GitLab",
        "username": "theredhacker0345",
        "url": "https://gitlab.com/theredhacker0345"
      },
      {
        "network": "X",
        "username": "Ubaid4tech",
        "url": "https://x.com/Ubaid4tech"
      },
      {
        "network": "Portfolio",
        "username": "ubaid-ur-rehmanportfolio",
        "url": "https://ubaid-ur-rehmanportfolio.vercel.app"
      }
    ]
  },
  "work": [
    {
      "name": "360 Muslim Experts",
      "position": "Technical Department Member",
      "url": "https://360me.pages.dev/team/2026",
      "startDate": "2025-01",
      "summary": "Technical team of a non-profit building software for a global Muslim community.",
      "highlights": [
        "Built and maintain Pak Books, a free bilingual (English/Urdu) digital library for students in Pakistan, deployed on Cloudflare Workers so it loads on a low-end Android over a slow connection."
      ]
    },
    {
      "name": "BS Studio",
      "position": "Full-Stack Developer",
      "url": "https://bs-studio.arifubaid0345.workers.dev/",
      "startDate": "2026-03",
      "summary": "Paid client engagement. Built and deployed an end-to-end platform for a paying client, live in production.",
      "highlights": [
        "Delivered a bilingual (RU/EN) agency platform with a Telegram ordering bot, a RAG assistant and a 15-tab admin panel.",
        "Deployed on Cloudflare Workers with D1 and Prisma; wrote the order intake, admin and assistant layers."
      ]
    },
    {
      "name": "KarobarX",
      "position": "Founder",
      "url": "https://karobarx.pages.dev",
      "startDate": "2025-01",
      "summary": "Trust-first social commerce platform for Pakistan, live and shipping.",
      "highlights": [
        "Designed the trust model: masked chat, a 6-digit Handshake PIN that confirms a meetup in person, and a public reputation score.",
        "Shipped the web app and an Android (Capacitor) client on Supabase, with row-level security on every user-facing table."
      ]
    }
  ],
  "skills": [
    {
      "name": "Security Research",
      "level": "Proven",
      "keywords": [
        "Static Analysis: shadowaudit — spec diff, SARIF, GitHub Action",
        "API Security: shadowaudit — 8 frameworks, OWASP API Top 10",
        "OWASP: OWASP API Top 10 across 7 frameworks",
        "Bug Bounty: 20 vulns across 3 real engagements",
        "Web Pentesting: EC-Council Hall of Fame — 9 vulns, 3 critical",
        "Responsible Disclosure: 3 engagements, 20 vulns, 6 critical",
        "F-Droid Security Audits: 12 apps audited for F-Droid inclusion"
      ]
    },
    {
      "name": "Languages",
      "level": "Proven",
      "keywords": [
        "Python: Nafs AI (PPO+GRU agent), Hermes agent pipeline",
        "Kotlin: Noor Connect — F-Droid published, 395+ downloads",
        "TypeScript: KarobarX full-stack marketplace (React + Supabase)",
        "Node.js: shadowaudit — npm CLI, SARIF output",
        "Rust: Neuron-Encrypt — Rust, AES-256-GCM-SIV"
      ]
    },
    {
      "name": "Frameworks & Tools",
      "level": "Proven",
      "keywords": [
        "Next.js: Portfolio site, shadowaudit dashboard",
        "React + Vite: KarobarX frontend, chatbot widget system",
        "Supabase: RLS hardening, pg_cron, JWT admin roles",
        "Cloudflare Workers + Pages: Zero-cost hosting across 3 live products",
        "Capacitor: KarobarX Android client"
      ]
    },
    {
      "name": "Development Workflow & Tooling",
      "level": "Proven",
      "keywords": [
        "AI-Assisted Engineering: Claude and Gemini alongside git-based implementation and testing"
      ]
    },
    {
      "name": "DevOps",
      "level": "Proven",
      "keywords": [
        "Git + GitHub Actions: CI for Hidayah OS ISO builds",
        "Bash: Watchdog scripts, ISO overlay system",
        "n8n: Pinterest affiliate pipelines, agent orchestration"
      ]
    }
  ],
  "projects": [
    {
      "name": "shadowaudit",
      "description": "Open-source CLI that finds API routes missing from the specification.",
      "highlights": [
        "Found 34 undocumented routes in Ghost CMS across 269 registered routes, with zero false positives once the analyser was taught to read middleware from the AST."
      ],
      "keywords": [
        "Node.js",
        "TypeScript",
        "SARIF",
        "GitHub Action",
        "OWASP API Top 10"
      ],
      "url": "https://gitlab.com/theredhacker0345/shadowaudit"
    },
    {
      "name": "Hidayah OS 1.1",
      "description": "Privacy-hardened Debian 13 distribution with a six-layer DNS shield.",
      "highlights": [
        "Blocks 5,732,267 domains at the resolver; the self-test on the release ISO passes 73 of 73 checks, and every release publishes a SHA-256 and three mirrors."
      ],
      "keywords": [
        "Debian 13",
        "Bash",
        "Python",
        "nftables",
        "systemd"
      ],
      "url": "https://hidayahos.gitlab.io"
    },
    {
      "name": "Noor Connect",
      "description": "Islamic companion app on F-Droid: 16 hadith collections, the Mushaf, 5 widgets.",
      "highlights": [
        "395+ installs on F-Droid, serving 52,000+ hadith entries offline from a 20 MB compressed database inflated in a Web Worker."
      ],
      "keywords": [
        "Kotlin",
        "React",
        "Capacitor",
        "F-Droid",
        "GPL-3.0"
      ],
      "url": "https://f-droid.org/packages/com.noorconnect.app"
    },
    {
      "name": "KarobarX",
      "description": "Trust-first marketplace for Pakistan: a 6-digit Handshake PIN, RLS on every table.",
      "highlights": [
        "Designed the trust model — masked chat, in-person confirmation by PIN, and a public reputation score — and shipped the web app with an Android client."
      ],
      "keywords": [
        "TypeScript",
        "React",
        "Supabase",
        "RLS",
        "Capacitor",
        "Cloudflare"
      ],
      "url": "https://karobarx.pages.dev"
    }
  ],
  "education": [
    {
      "institution": "Govt. College of Technology, Karachi",
      "studyType": "DAE",
      "areas": [
        "Electronics Technology"
      ],
      "startDate": "2024-12"
    },
    {
      "institution": "Govt. College of Commerce & Economics 2, Karachi",
      "studyType": "ICS",
      "areas": [
        "Information Computer Science"
      ],
      "startDate": "2024-12"
    },
    {
      "institution": "Sir Syed Children Academy, Karachi",
      "studyType": "Matriculation",
      "areas": [
        "Science"
      ],
      "startDate": "2024",
      "endDate": "2024"
    }
  ],
  "certificates": [
    {
      "name": "CyberOps Associate — Networking Basics",
      "issuer": "Saylani",
      "date": "2026-06"
    },
    {
      "name": "Introduction to Dark Web, Anonymity, and Cryptocurrency",
      "issuer": "EC-Council",
      "date": "2026-04"
    },
    {
      "name": "Network Technician Career Path",
      "issuer": "Saylani Cisco",
      "date": "2026-03"
    },
    {
      "name": "IBM Bob 2.0 Hackathon — Certificate of Completion",
      "issuer": "lablab.ai (NativelyAI) for IBM",
      "date": "2026-09",
      "url": "https://lablab.ai/u/@theredhacker0345/ai-hackathons/ibm-bob-2-hackathon/certificate"
    }
  ],
  "awards": [
    {
      "title": "EC-Council Hall of Fame 2026",
      "awarder": "EC-Council",
      "date": "2026-05",
      "summary": "For 9 vulnerabilities (3 Critical) across EC-Council web assets."
    }
  ],
  "languages": [
    {
      "language": "English",
      "fluency": "Professional"
    },
    {
      "language": "Urdu",
      "fluency": "Native"
    },
    {
      "language": "Arabic",
      "fluency": "Conversational (Quranic)"
    }
  ],
  "interests": [
    {
      "name": "Security research",
      "keywords": [
        "Bug bounty",
        "API security",
        "Web pentesting",
        "Responsible disclosure",
        "F-Droid audits"
      ]
    },
    {
      "name": "Developer tooling",
      "keywords": [
        "CLI tools",
        "Static analysis",
        "SARIF",
        "GitHub Action",
        "npm"
      ]
    },
    {
      "name": "Android and Linux systems",
      "keywords": [
        "Kotlin",
        "Debian 13",
        "nftables",
        "systemd",
        "F-Droid"
      ]
    },
    {
      "name": "Applied AI",
      "keywords": [
        "AI-assisted engineering",
        "n8n",
        "Automation",
        "nafs-ai"
      ]
    },
    {
      "name": "Open source",
      "keywords": [
        "Inkscape",
        "Wireshark",
        "gitlab-shell",
        "OpenMW",
        "GitLab Docs"
      ]
    }
  ],
  "writing": [
    {
      "title": "Prompting is a dead end. We need to talk about Orchestration.",
      "url": "https://medium.com/h7w/prompting-is-a-dead-end-we-need-to-talk-about-orchestration-e33c5c5890bc",
      "date": "2026-10",
      "publication": "T3CH on Medium"
    },
    {
      "title": "The Most Feature-Rich Islamic App Ever Built — And It’s Completely Free and Open Source",
      "url": "https://medium.com/@arifubaid0345/the-most-feature-rich-islamic-app-ever-built-and-its-completely-free-and-open-source-393d3d284051",
      "date": "2026-08",
      "publication": "Ubaid Ur Rehman on Medium"
    }
  ],
  "availability": {
    "openToWork": true,
    "rolesSought": [
      "Full-Stack Engineer",
      "Security Researcher"
    ],
    "workModes": [
      "Remote",
      "Relocation"
    ],
    "timezone": "UTC+5 (Asia/Karachi)",
    "responseTime": "Within 2 hours for project enquiries; usually the same working day otherwise",
    "contact": {
      "email": "arifubaid0345@gmail.com"
    }
  },
  "ats": {
    "keywords": [
      "Static Analysis",
      "API Security",
      "OWASP",
      "Bug Bounty",
      "Web Pentesting",
      "Responsible Disclosure",
      "F-Droid Security Audits",
      "Python",
      "Kotlin",
      "TypeScript",
      "Node.js",
      "Rust",
      "Next.js",
      "React + Vite",
      "Supabase",
      "Cloudflare Workers + Pages",
      "Capacitor",
      "AI-Assisted Engineering",
      "Git + GitHub Actions",
      "Bash",
      "n8n",
      "SARIF",
      "GitHub Action",
      "OWASP API Top 10",
      "Debian 13",
      "nftables",
      "systemd",
      "React",
      "F-Droid",
      "GPL-3.0",
      "RLS",
      "Cloudflare",
      "gitlab-shell",
      "Inkscape 1.5",
      "GitLab Docs",
      "Wireshark",
      "OpenMW",
      "EC-Council (CodeRed)",
      "PriceOye",
      "Waqar Electronics"
    ],
    "yearsOfExperience": 2,
    "highestEducation": {
      "degree": "DAE, Electronics Technology — 2nd year of 3",
      "institution": "Govt. College of Technology, Karachi",
      "studyType": "DAE",
      "areas": [
        "Electronics Technology"
      ],
      "startDate": "2024-12",
      "status": "In progress"
    }
  },
  "meta": {
    "canonical": "https://ubaid-ur-rehmanportfolio.vercel.app/cv",
    "note": "Generated from the same source as the portfolio and the HTML CV, so the three cannot drift apart.",
    "generatedAt": "2026-10-19T17:50:28.073Z",
    "version": "1.0.0"
  }
}