the longer version.

I'm a backend engineer in Islamabad. I write Python and Go, ship PHP and CodeIgniter at my day job, and most of my evenings turn into security tooling.

What I keep coming back to is how much code ships without anyone really reading it. Security shows up on the roadmap around the same time the first incident does. That gap is the work I want to do.

My senior project at FAST-NUCES was IntraSec, a client-less network vulnerability scanner in Python and Go, supervised by Dr. Muhammad Asim. Building it is what made me want to do this for real.

That line of work turned into Beruni, the startup I'm building at ByteOrb: a read-only AWS security scanner for the startups that can't justify enterprise security pricing. Same instinct as IntraSec (no agents, read-only, work out the risk from the outside), pointed at the cloud. It's in closed beta.

By day it's a multi-tenant hospitality SaaS at SageTeck: REST APIs, auth, deployment pipelines. On the side, I look at how AI-assisted codebases get exploited: vulnerabilities most reviews miss because they're too new to have names yet.

For the stack details, see my CV.

Outside that: چائے

building something in backend, infra, or security? or just want to compare notes.
arfat@duck.com →