# Ubaid-Ur-Rehman - Portfolio

> Full-Stack Engineer & Security Researcher from Nazimabad, Karachi, Pakistan (UTC+5). 15 shipped products, 20 disclosed vulnerabilities across 3 engagements, 12 F-Droid app audits, 3 upstream merges, EC-Council Hall of Fame 2026.

This is the full portfolio in one file. It is generated from the same data as the website and the CV, so the claims here are the claims the site makes.

## Profile

- **Name**: Ubaid-Ur-Rehman
- **Role**: Full-Stack Engineer & Security Researcher — Karachi, Pakistan
- **Location**: Nazimabad, Karachi, Pakistan (UTC+5)
- **Email**: arifubaid0345@gmail.com
- **Portfolio**: https://ubaid-ur-rehmanportfolio.vercel.app
- **GitHub**: https://github.com/theredhacker0345
- **GitLab**: https://gitlab.com/theredhacker0345
- **X**: https://x.com/Ubaid4tech
- **Targeting**: Open to full-stack and security engineering roles — remote or relocation. Everything below is checkable: three patches merged into projects I do not own, nine vulnerabilities acknowledged by EC-Council in 2026, and a published CLI with a GitHub Action. Portfolio: https://ubaid-ur-rehmanportfolio.vercel.app

## Summary

Full-stack engineer and security researcher, 2 years of shipped work. 20 disclosed vulnerabilities across 3 engagements, 12 F-Droid app audits, 3 patches merged upstream into Inkscape, Wireshark and gitlab-shell, and 15 products shipped — Android apps, web platforms, a Linux distribution and an npm CLI. Built with AI-assisted development and human review of every merge request.

## Key metrics

- **20** - vulns, 3 engagements
- **12** - F-Droid audits
- **3** - upstream merges
- **15** - products shipped
- **5.7M** - domains blocked

## Experience

### Technical Department Member - 360 Muslim Experts

- **Period**: Jan 2025 — Present
- **Organisation**: https://360me.pages.dev/team/2026

Technical team of a non-profit building software for a global Muslim community.

- Built and maintain Pak Books, a free bilingual (English/Urdu) digital library for students in Pakistan, deployed on Cloudflare Workers so it loads on a low-end Android over a slow connection.

### Full-Stack Developer - BS Studio

- **Period**: Mar 2026 — Present
- **Organisation**: https://bs-studio.arifubaid0345.workers.dev/

Paid client engagement. Built and deployed an end-to-end platform for a paying client, live in production.

- Delivered a bilingual (RU/EN) agency platform with a Telegram ordering bot, a RAG assistant and a 15-tab admin panel.
- Deployed on Cloudflare Workers with D1 and Prisma; wrote the order intake, admin and assistant layers.

### Founder - KarobarX

- **Period**: Jan 2025 — Present
- **Organisation**: https://karobarx.pages.dev

Trust-first social commerce platform for Pakistan, live and shipping.

- Designed the trust model: masked chat, a 6-digit Handshake PIN that confirms a meetup in person, and a public reputation score.
- Shipped the web app and an Android (Capacitor) client on Supabase, with row-level security on every user-facing table.

## Skills

Every skill carries the artefact that proves it.

### Security Research

- **Static Analysis** - shadowaudit — spec diff, SARIF, GitHub Action
- **API Security** - shadowaudit — 8 frameworks, OWASP API Top 10
- **OWASP** - OWASP API Top 10 across 7 frameworks
- **Bug Bounty** - 20 vulns across 3 real engagements
- **Web Pentesting** - EC-Council Hall of Fame — 9 vulns, 3 critical
- **Responsible Disclosure** - 3 engagements, 20 vulns, 6 critical
- **F-Droid Security Audits** - 12 apps audited for F-Droid inclusion

### Languages

- **Python** - Nafs AI (PPO+GRU agent), Hermes agent pipeline
- **Kotlin** - Noor Connect — F-Droid published, 395+ downloads
- **TypeScript** - KarobarX full-stack marketplace (React + Supabase)
- **Node.js** - shadowaudit — npm CLI, SARIF output
- **Rust** - Neuron-Encrypt — Rust, AES-256-GCM-SIV

### Frameworks & Tools

- **Next.js** - Portfolio site, shadowaudit dashboard
- **React + Vite** - KarobarX frontend, chatbot widget system
- **Supabase** - RLS hardening, pg_cron, JWT admin roles
- **Cloudflare Workers + Pages** - Zero-cost hosting across 3 live products
- **Capacitor** - KarobarX Android client

### Development Workflow & Tooling

- **AI-Assisted Engineering** - Claude and Gemini alongside git-based implementation and testing

### DevOps

- **Git + GitHub Actions** - CI for Hidayah OS ISO builds
- **Bash** - Watchdog scripts, ISO overlay system
- **n8n** - Pinterest affiliate pipelines, agent orchestration

## Selected projects

The projects the CV leads with, each with one number in it.

### shadowaudit

Open-source CLI that finds API routes missing from the specification.

- Found 34 undocumented routes in Ghost CMS across 269 registered routes, with zero false positives once the analyser was taught to read middleware from the AST.
- **Technologies**: Node.js, TypeScript, SARIF, GitHub Action, OWASP API Top 10
- **Link**: https://gitlab.com/theredhacker0345/shadowaudit

### Hidayah OS 1.1

Privacy-hardened Debian 13 distribution with a six-layer DNS shield.

- Blocks 5,732,267 domains at the resolver; the self-test on the release ISO passes 73 of 73 checks, and every release publishes a SHA-256 and three mirrors.
- **Technologies**: Debian 13, Bash, Python, nftables, systemd
- **Link**: https://hidayahos.gitlab.io

### Noor Connect

Islamic companion app on F-Droid: 16 hadith collections, the Mushaf, 5 widgets.

- 395+ installs on F-Droid, serving 52,000+ hadith entries offline from a 20 MB compressed database inflated in a Web Worker.
- **Technologies**: Kotlin, React, Capacitor, F-Droid, GPL-3.0
- **Link**: https://f-droid.org/packages/com.noorconnect.app

### KarobarX

Trust-first marketplace for Pakistan: a 6-digit Handshake PIN, RLS on every table.

- Designed the trust model — masked chat, in-person confirmation by PIN, and a public reputation score — and shipped the web app with an Android client.
- **Technologies**: TypeScript, React, Supabase, RLS, Capacitor, Cloudflare
- **Link**: https://karobarx.pages.dev

## Project catalogue

Everything that has been shipped, with the case study for each.

### theredhacker0345/Eco-Trace

Desktop energy-intelligence platform for Android engineers — runs 23 detectors over Java/Kotlin sources, builds a real cross-file call graph, and traces every finding back to the architectural decision that caused it. Built during the 48-hour IBM Bob 2.0 hackathon (Sep 2026).

- Reasons about cause, not symptoms: builds a genuine cross-file call graph and walks backwards from each finding to its lifecycle entry point, so a leaked wakelock in NetworkManager is reported as the symptom of a wakeup alarm registered in MainActivity that re-arms the path 96 times a day
- 23 energy detectors across wakefulness, network, location and lifecycle patterns — unclosed WakeLocks, postDelayed polling loops, sub-30-second GPS intervals, and JobInfo constraints written but never submitted
- Whole-repository reasoning with IBM Bob 2.0: Bob holds every file in a single pass, revises severities, corrects descriptions, and writes a fix against the specific traced chain — including defects the local pass attributes to the wrong method
- Self-verifying patch loop: Bob proposes a patch, EcoTrace re-runs its own detectors over it, and any patch that silences a rule by deleting the construct is rejected. Accepted changes land on a branch for human merge, never straight to main
- Measures real drain where devices are available: parses adb shell dumpsys batterystats snapshots and differences them into a drain rate in mAh/min attributed to the app under test rather than the whole device
- Honest provenance and zero-key operation: every figure reports whether it is measured, estimator-derived, or unknown, and all 23 detectors, call-graph chains, grading, history and reporting run offline, deterministically and free — Bob sharpens the analysis but is never a prerequisite
- Output is a self-contained HTML or PDF report that attaches to a ticket, plus an optional one-click patch that is authored, verified and branched for review

- **Source**: https://github.com/theredhacker0345/Eco-Trace
- **Homepage**: https://theredhacker0345.github.io/Eco-Trace/
- **Case study**: https://ubaid-ur-rehmanportfolio.vercel.app/work/ecotrace
- **Status**: Shipped

### hidayahos/Hidayah-os-making

Privacy-hardened Debian 13 Linux distribution for Muslim families — the Ihsan 1.1 ISO ships one Xfce desktop and a six-layer shield: a local DNS filter on 127.0.0.1:53 blocking 5,732,267 domains, forced SafeSearch, DNS-hijack prevention, hardened kernel settings, a polkit-protected toggle, prayer-time Focus Mode, four custom Hidayah apps, the Noor Connect offline PWA, 81 NSFW-verified wallpapers, and a 73-check self-test that passes 73 of 73 on the release build.

- Sovereign Shield: local filtering DNS daemon (127.0.0.1:53, 5,732,267 domains) with NXDOMAIN break-tests, DNS-hijack prevention (resolv.conf pinned, systemd-resolved masked), forced SafeSearch endpoints, and a daily-refreshing blocklist with an offline seed list
- Six layers, not one: DNS filter, daily refresh, hijack prevention, hardened kernel sysctls and module blacklists, a polkit-protected toggle, and a reversible prayer-time Focus Mode — because a blocklist any app can hardcode around is a suggestion
- Faith workflow built into the image: astronomical prayer times with six calculation methods and athan notifications, the Current Ayah viewer, a branded Khal wrapper, dashboard feeds written to ~/.cache/hidayah, and the Noor Connect offline PWA (Quran reader, tasbih, community board)
- Trust chain: hidayah-doctor 73-check self-test ships on the ISO (PASS 73 · FAIL 0), SHA-256 published for every release, three download mirrors (GitLab, Internet Archive, BitTorrent), and a reproducible build pipeline on Kaggle with a QEMU QA harness

- **Source**: https://gitlab.com/hidayahos/Hidayah-os-making
- **Homepage**: https://hidayahos.gitlab.io
- **Status**: v1.1 · Live

### karobarx/karobarx

Trust-first social-commerce platform for Pakistan, built with React, Supabase, Cloudflare Pages, and Capacitor. It focuses on safer transactions, fast product discovery, and student needs.

- Trust layer: masked chat, delivery-verification flow, and reputation signals
- Short-form Reel discovery feed with Cloudflare R2 media storage
- Student ecosystem: Study Graph, ISBN-based Book Exchange, and Student Alerts
- Security posture: RLS, Turnstile, HttpOnly admin cookies, TOTP 2FA, audit logs, and a stricter admin CSP

- **Source**: https://karobarx.pages.dev
- **Homepage**: https://karobarx.pages.dev
- **Status**: Startup · Live

### 360MuslimExperts/Pak-books

Free digital library for Pakistani students, built for 360 Muslim Experts. It brings textbooks, notes, past papers, and learning resources into a bilingual web experience with Telegram-based discovery; public usage metrics are not yet published.

- Next.js 16 + Cloudflare Pages + D1 + Workers KV + Internet Archive S3
- Telegram Bot with inline mode, fuzzy search, and a delete-my-data flow
- Kaggle operations with scheduled mirror and maintenance jobs
- Bilingual English/Urdu interface with RTL support, dark/light theme, PWA, and accessibility settings

- **Source**: https://pak-books.pages.dev
- **Homepage**: https://pak-books.pages.dev
- **Status**: Project · Live

### theredhacker0345/shadowaudit

Open source CLI security tool that detects unauthenticated and undocumented API routes via static analysis. Supports Express, FastAPI, Django, Flask, NestJS, Rails, and Spring Boot. Maps findings to OWASP API Top 10 with risk scoring.

- Static analysis engine with multi-framework scanner support
- OWASP API Top 10 risk mapping with severity scoring
- Published on npm with active community usage
- GitHub Action integration for CI/CD pipelines
- Live dashboard at shadowaudit-dashboard.vercel.app

- **Source**: https://gitlab.com/theredhacker0345/shadowaudit
- **Homepage**: https://shadowaudit-dashboard.vercel.app
- **Status**: Active development

### theredhacker0345/Noor-connect

Islamic companion app — 395+ downloads on F-Droid. Nasheeds, Quran radio, Qibla, prayer times, 5 Android widgets.

- Privacy-first Islamic companion app with no tracking
- Published on F-Droid with 395+ downloads
- Nasheeds, Quran radio, Qibla, prayer times, 5 Android widgets

- **Source**: https://gitlab.com/theredhacker0345/Noor-connect
- **Homepage**: https://f-droid.org

### theredhacker0345/HaramVeil

Privacy-first, Islamic-values-aligned, FOSS GPL-v3 on-device content-filtering Android app.

- On-device content filtering with Islamic values alignment
- GPL-v3 licensed, fully open source
- Kotlin + Jetpack Compose, Capacitor for Android

- **Source**: https://gitlab.com/theredhacker0345/HaramVeil

### theredhacker0345/Neuron-Encrypt

Transparent, open-source file encryption application featuring cryptographic security software.

- AES-256-GCM-SIV, a nonce-misuse-resistant AEAD, with per-file random nonces
- Rust implementation with zero dependencies
- Cross-platform: Linux, macOS, Windows

- **Source**: https://gitlab.com/theredhacker0345/Neuron-Encrypt

### theredhacker0345/nafs-ai

Simulation of a primitive AI agent with zero world knowledge.

- PPO + GRU based agent architecture
- Zero-shot learning simulation
- Python + PyTorch implementation

- **Source**: https://gitlab.com/theredhacker0345/nafs-ai

### theredhacker0345/HAYAT-AI

Offline-first mobile medical assistant for high-conflict and crisis zones like Gaza and Kashmir. Provides physician-validated emergency protocols without internet.

- Offline-first medical assistant with no internet dependency
- Physician-validated emergency protocols for trauma, surgery, and first aid
- Designed for crisis zones with high-conflict environments

- **Source**: https://gitlab.com/theredhacker0345/HAYAT-AI
- **Status**: Project · Live

### theredhacker0345/Onionroute-Lite

Lightweight Orbot alternative for low-end Android. Tor VPN, SOCKS5/HTTP proxy, obfs4 and snowflake bridges, kill switch.

- Lightweight Tor VPN alternative optimized for low-end Android devices
- SOCKS5/HTTP proxy support with obfs4 and snowflake bridges
- F-Droid compliant, GPL-3.0 licensed

- **Source**: https://gitlab.com/theredhacker0345/Onionroute-Lite
- **Status**: Project · Live

### theredhacker0345/pocket-relay

Self-hosted Android agent host with private Telegram control and embedded runtime.

- Self-hosted agent runtime for Android with private Telegram control
- Embedded runtime with no cloud dependency
- GPL-3.0 licensed with active development

- **Source**: https://gitlab.com/theredhacker0345/pocket-relay
- **Status**: Project · Live

### theredhacker0345/nofapfursan

Elite sovereign Command Centre for masculine discipline. Decentralized via Nostr with end-to-end NIP-44 encryption, featuring active Mindset Interventions and Biological Signal tracking.

- Nostr decentralized architecture with NIP-44 end-to-end encryption
- Mindset Interventions and Biological Signal tracking
- No servers, no tracking — fully sovereign design

- **Source**: https://gitlab.com/theredhacker0345/nofapfursan
- **Status**: Project · Live

### theredhacker0345/Photon-Dns

Android local-VPN DNS resolver manager with bounded DNS forwarding and resolver latency monitoring.

- DNS-over-UDP, strict DNS-over-HTTPS, and strict DNS-over-TLS resolver support
- Per-resolver latency checks and automatic switching with cooldown and hysteresis
- Kotlin + Jetpack Compose with bounded packet handling and protected upstream sockets

- **Source**: https://gitlab.com/theredhacker0345/Photon-Dns

### theredhacker0345/synthetic-spirit

High-performance Android DNS sinkhole with a large malicious, tracking, and adult-content domain database.

- 200,000+ domain blocklist covering malware, tracking, and adult content
- Jetpack Compose UI with Material Design 3
- Local-only processing with zero telemetry

- **Source**: https://gitlab.com/theredhacker0345/synthetic-spirit

## Security research

### EC-Council (CodeRed)

- **Findings**: 9 vulnerabilities (3 Critical)
- **Outcome**: Hall of Fame 2026

Nine vulnerabilities, three of them critical, across EC-Council web assets. Acknowledged the same day.

### PriceOye

- **Findings**: 5 vulnerabilities (3 Critical PII leaks)
- **Outcome**: Acknowledged, remediated

Five vulnerabilities, three critical PII exposures. Remediation confirmed within 72 hours.

### Waqar Electronics

- **Findings**: 6 vulnerabilities (XSS-to-ATO chain)
- **Outcome**: Acknowledged, remediated

Six vulnerabilities, including a stored XSS-to-account-takeover chain via insecure session cookies.

## Open source contributions

### F-Droid — 12 app audits and inclusion submissions

Audited 12 apps for F-Droid inclusion, publishing a report on each merge request. 6 submissions authored, 4 merged.

- **Link**: https://gitlab.com/fdroid/fdroiddata/-/merge_requests/35617

### GitLab - gitlab-shell

Fixed JWT refresh bug before rate-limit retries — preventing authentication failures under retry pressure.

- **Merge request**: !1534 (merged)
- **Link**: https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/1534

### Inkscape - Inkscape 1.5

Fixed the Wide Screen preference-state regression so the action restores correctly after interface-mode changes and restart.

- **Merge request**: !8122 (merged)
- **Link**: https://gitlab.com/inkscape/inkscape/-/merge_requests/8122

### GitLab - GitLab Docs

Fixed test environment fallback mounts configuration — restored English-only doc resolution for localized sites (Japanese, French, Korean) by removing duplicate module.mounts override and adding --environment test to review-app CI. Closes #708.

- **Merge request**: !2558 (open)
- **Link**: https://gitlab.com/gitlab-org/technical-writing/docs-gitlab-com/-/merge_requests/2558

### Wireshark - Wireshark

Corrected the Bluetooth LE channel-map labels in the dissector — the decoded channel values were mislabelled against the Core Specification.

- **Merge request**: !26301 (merged)
- **Link**: https://gitlab.com/wireshark/wireshark/-/merge_requests/26301

### OpenMW - OpenMW

Documented a launcher-first mod-installation path so users can manage data directories without manually editing openmw.cfg.

- **Merge request**: !5547 (open)
- **Link**: https://gitlab.com/OpenMW/openmw/-/merge_requests/5547

## Certifications

- **CyberOps Associate — Networking Basics** - Saylani, Jun 2026
- **Introduction to Dark Web, Anonymity, and Cryptocurrency** - EC-Council, Apr 2026
- **Network Technician Career Path** - Saylani Cisco, Mar 2026
- **IBM Bob 2.0 Hackathon — Certificate of Completion** - lablab.ai (NativelyAI) for IBM, Sep 2026 - https://lablab.ai/u/@theredhacker0345/ai-hackathons/ibm-bob-2-hackathon/certificate

## Education

- **DAE, Electronics Technology — 2nd year of 3** - Govt. College of Technology, Karachi, Dec 2024 — Present
- **ICS, Information Computer Science — 2nd year of 2** - Govt. College of Commerce & Economics 2, Karachi, Dec 2024 — Present
- **Matriculation, Science** - Sir Syed Children Academy, Karachi, 2024

## Awards

- **EC-Council Hall of Fame 2026** - EC-Council, May 2026
  - For 9 vulnerabilities (3 Critical) across EC-Council web assets.

## Languages

- **English** - Professional
- **Urdu** - Native
- **Arabic** - Conversational (Quranic)

## Writing

- **Prompting is a dead end. We need to talk about Orchestration.** - T3CH on Medium, Oct 2026
  - https://medium.com/h7w/prompting-is-a-dead-end-we-need-to-talk-about-orchestration-e33c5c5890bc
- **The Most Feature-Rich Islamic App Ever Built — And It’s Completely Free and Open Source** - Ubaid Ur Rehman on Medium, Aug 2026
  - https://medium.com/@arifubaid0345/the-most-feature-rich-islamic-app-ever-built-and-its-completely-free-and-open-source-393d3d284051