Threat Intelligence · Security Engineering · Arabic/RTL Engineering

I build and improve practical security software, focusing on reliable event processing, threat-intelligence integrations, defensive data handling, and Arabic-first user experiences.

GitHub · العربية

Merged

Fixed a live-log polling bug that could skip events because SQLite compared timestamp strings with inconsistent UTC offsets.

• Normalized stored timestamps and query cursors to UTC.
• Added a compound (timestamp, event_id) cursor to avoid skipped or repeated events across equal timestamps and filtered batches.
• Made timestamp tie ordering deterministic.
• Added regression and SQLite integration tests.

Validation reported for the change: go test ./tui/... ./storage/..., go vet, and go build passed.

Landed in main

Improved reliability in the Fusion event pipeline:

• Commit Kafka offsets only after durable processing or successful dead-letter-queue capture.
• Add tenant-scoped uniqueness for alert deduplication.
• Improve bounded retries, cache-failure handling, and dead-letter-queue safeguards.

The original PR was closed after a fork-permission issue prevented maintainers from rebasing it. The maintainer confirmed that the contribution was carried into main through PR #1491, with authorship and attribution retained. The focused validation reported in the original PR included 126 passing tests.

Open pull request

Made malformed threat_score= records non-fatal to feed synchronization:

• Skip malformed records instead of aborting the sync.
• Log sanitized warnings without exposing raw untrusted record content.
• Neutralize control characters and bound logged fields to reduce log-injection risk.
• Add 9 regression tests.

Prepared a broad Arabic-support patch covering RTL layout, Arabic localization, Arabic-aware search normalization, Arabic text-to-speech, and Hijri calendar support. The work included Arabic normalization tests and localization-integrity checks.

Status: The pull request was closed by repository automation because it did not meet the project's submission requirements (target branch, linked issue/discussion, and CLA text). It was not merged.

• Threat intelligence: STIX 2.1, OpenCTI feeds and connectors, pycti.
• Security engineering: event-pipeline reliability, defensive input handling, sanitized logging, regression testing.
• Backend and data systems: Python, Go, Kafka, PostgreSQL, SQLite.
• Arabic and RTL: localization catalogs, bidirectional layouts, Arabic text normalization, search and retrieval.

Python · Go · STIX 2.1 · OpenCTI · pycti · Kafka · PostgreSQL · SQLite · pytest · Git · GitHub Actions · TypeScript · Svelte · i18n · RTL · Linux

Root cause first. Evidence over claims. Tests for regressions.

I aim to make changes that are reviewable, maintainable, and explicit about both what was verified and what remains unverified.

Interested in CTFs, security research, threat intelligence, and open-source engineering.

Open an issue or discussion on one of my repositories to get in touch.

Building reliable software at the intersection of security, systems, and language.