Ubaid-Ur-Rehman Full-Stack Engineer & Security Researcher Nazimabad, Karachi, Pakistan arifubaid0345@gmail.com https://github.com/theredhacker0345 https://gitlab.com/theredhacker0345 https://ubaid-ur-rehmanportfolio.vercel.app Open to full-stack and security engineering roles - remote or relocation. Everything below is checkable: three patches merged into projects I do not own, nine vulnerabilities acknowledged by EC-Council in 2026, and a published CLI with a GitHub Action. Portfolio: https://ubaid-ur-rehmanportfolio.vercel.app SUMMARY Full-stack engineer and security researcher, 2 years of shipped work. 20 disclosed vulnerabilities across 3 engagements, 12 F-Droid app audits, 3 patches merged upstream into Inkscape, Wireshark and gitlab-shell, and 15 products shipped - Android apps, web platforms, a Linux distribution and an npm CLI. Built with AI-assisted development and human review of every merge request. 20 - vulns, 3 engagements 12 - F-Droid audits 3 - upstream merges 15 - products shipped 5.7M - domains blocked EXPERIENCE Technical Department Member - 360 Muslim Experts Jan 2025 - Present https://360me.pages.dev/team/2026 Technical team of a non-profit building software for a global Muslim community. - Built and maintain Pak Books, a free bilingual (English/Urdu) digital library for students in Pakistan, deployed on Cloudflare Workers so it loads on a low-end Android over a slow connection. Full-Stack Developer - BS Studio Mar 2026 - Present https://bs-studio.arifubaid0345.workers.dev/ Paid client engagement. Built and deployed an end-to-end platform for a paying client, live in production. - Delivered a bilingual (RU/EN) agency platform with a Telegram ordering bot, a RAG assistant and a 15-tab admin panel. - Deployed on Cloudflare Workers with D1 and Prisma; wrote the order intake, admin and assistant layers. Founder - KarobarX Jan 2025 - Present https://karobarx.pages.dev Trust-first social commerce platform for Pakistan, live and shipping. - Designed the trust model: masked chat, a 6-digit Handshake PIN that confirms a meetup in person, and a public reputation score. - Shipped the web app and an Android (Capacitor) client on Supabase, with row-level security on every user-facing table. SKILLS Security Research - Static Analysis: shadowaudit - spec diff, SARIF, GitHub Action - API Security: shadowaudit - 8 frameworks, OWASP API Top 10 - OWASP: OWASP API Top 10 across 7 frameworks - Bug Bounty: 20 vulns across 3 real engagements - Web Pentesting: EC-Council Hall of Fame - 9 vulns, 3 critical - Responsible Disclosure: 3 engagements, 20 vulns, 6 critical - F-Droid Security Audits: 12 apps audited for F-Droid inclusion Languages - Python: Nafs AI (PPO+GRU agent), Hermes agent pipeline - Kotlin: Noor Connect - F-Droid published, 395+ downloads - TypeScript: KarobarX full-stack marketplace (React + Supabase) - Node.js: shadowaudit - npm CLI, SARIF output - Rust: Neuron-Encrypt - Rust, AES-256-GCM-SIV Frameworks & Tools - Next.js: Portfolio site, shadowaudit dashboard - React + Vite: KarobarX frontend, chatbot widget system - Supabase: RLS hardening, pg_cron, JWT admin roles - Cloudflare Workers + Pages: Zero-cost hosting across 3 live products - Capacitor: KarobarX Android client Development Workflow & Tooling - AI-Assisted Engineering: Claude and Gemini alongside git-based implementation and testing DevOps - Git + GitHub Actions: CI for Hidayah OS ISO builds - Bash: Watchdog scripts, ISO overlay system - n8n: Pinterest affiliate pipelines, agent orchestration PROJECTS shadowaudit https://gitlab.com/theredhacker0345/shadowaudit Open-source CLI that finds API routes missing from the specification. Found 34 undocumented routes in Ghost CMS across 269 registered routes, with zero false positives once the analyser was taught to read middleware from the AST. Technologies: Node.js, TypeScript, SARIF, GitHub Action, OWASP API Top 10 Hidayah OS 1.1 https://hidayahos.gitlab.io Privacy-hardened Debian 13 distribution with a six-layer DNS shield. Blocks 5,732,267 domains at the resolver; the self-test on the release ISO passes 73 of 73 checks, and every release publishes a SHA-256 and three mirrors. Technologies: Debian 13, Bash, Python, nftables, systemd Noor Connect https://f-droid.org/packages/com.noorconnect.app Islamic companion app on F-Droid: 16 hadith collections, the Mushaf, 5 widgets. 395+ installs on F-Droid, serving 52,000+ hadith entries offline from a 20 MB compressed database inflated in a Web Worker. Technologies: Kotlin, React, Capacitor, F-Droid, GPL-3.0 KarobarX https://karobarx.pages.dev Trust-first marketplace for Pakistan: a 6-digit Handshake PIN, RLS on every table. Designed the trust model - masked chat, in-person confirmation by PIN, and a public reputation score - and shipped the web app with an Android client. Technologies: TypeScript, React, Supabase, RLS, Capacitor, Cloudflare OPEN SOURCE CONTRIBUTIONS F-Droid - 12 app audits and inclusion submissions Audited 12 apps for F-Droid inclusion, publishing a report on each merge request. 6 submissions authored, 4 merged. https://gitlab.com/fdroid/fdroiddata/-/merge_requests/35617 GitLab - gitlab-shell Fixed JWT refresh bug before rate-limit retries - preventing authentication failures under retry pressure. Merge Request !1534 - Merged https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/1534 Inkscape - Inkscape 1.5 Fixed the Wide Screen preference-state regression so the action restores correctly after interface-mode changes and restart. Merge Request !8122 - Merged https://gitlab.com/inkscape/inkscape/-/merge_requests/8122 GitLab - GitLab Docs Fixed test environment fallback mounts configuration - restored English-only doc resolution for localized sites (Japanese, French, Korean) by removing duplicate module.mounts override and adding --environment test to review-app CI. Closes #708. Merge Request !2558 - Open https://gitlab.com/gitlab-org/technical-writing/docs-gitlab-com/-/merge_requests/2558 Wireshark - Wireshark Corrected the Bluetooth LE channel-map labels in the dissector - the decoded channel values were mislabelled against the Core Specification. Merge Request !26301 - Merged https://gitlab.com/wireshark/wireshark/-/merge_requests/26301 OpenMW - OpenMW Documented a launcher-first mod-installation path so users can manage data directories without manually editing openmw.cfg. Merge Request !5547 - Open https://gitlab.com/OpenMW/openmw/-/merge_requests/5547 SECURITY RESEARCH EC-Council (CodeRed) - 9 vulnerabilities (3 Critical) Nine vulnerabilities, three of them critical, across EC-Council web assets. Acknowledged the same day. Outcome: Hall of Fame 2026 PriceOye - 5 vulnerabilities (3 Critical PII leaks) Five vulnerabilities, three critical PII exposures. Remediation confirmed within 72 hours. Outcome: Acknowledged, remediated Waqar Electronics - 6 vulnerabilities (XSS-to-ATO chain) Six vulnerabilities, including a stored XSS-to-account-takeover chain via insecure session cookies. Outcome: Acknowledged, remediated CERTIFICATIONS CyberOps Associate - Networking Basics Issuer: Saylani Date: Jun 2026 Introduction to Dark Web, Anonymity, and Cryptocurrency Issuer: EC-Council Date: Apr 2026 Network Technician Career Path Issuer: Saylani Cisco Date: Mar 2026 IBM Bob 2.0 Hackathon - Certificate of Completion Issuer: lablab.ai (NativelyAI) for IBM Date: Sep 2026 https://lablab.ai/u/@theredhacker0345/ai-hackathons/ibm-bob-2-hackathon/certificate EDUCATION DAE, Electronics Technology - 2nd year of 3 Govt. College of Technology, Karachi Dec 2024 - Present ICS, Information Computer Science - 2nd year of 2 Govt. College of Commerce & Economics 2, Karachi Dec 2024 - Present Matriculation, Science Sir Syed Children Academy, Karachi 2024 AWARDS EC-Council Hall of Fame 2026 Awarded by: EC-Council Date: May 2026 For 9 vulnerabilities (3 Critical) across EC-Council web assets. WRITING Prompting is a dead end. We need to talk about Orchestration. T3CH on Medium - Oct 2026 https://medium.com/h7w/prompting-is-a-dead-end-we-need-to-talk-about-orchestration-e33c5c5890bc The Most Feature-Rich Islamic App Ever Built - And It's Completely Free and Open Source Ubaid Ur Rehman on Medium - Aug 2026 https://medium.com/@arifubaid0345/the-most-feature-rich-islamic-app-ever-built-and-its-completely-free-and-open-source-393d3d284051 LANGUAGES English - Professional Urdu - Native Arabic - Conversational (Quranic)