I’m Syed Ali Mehdi, a software and AI engineer.
I’m Syed Ali Mehdi, a software and AI engineer.
Most of what I build is meant to run in production: scraping and validation pipelines, RAG copilots that answer questions about a codebase, and evaluation setups that run in CI for LLM apps. The part I enjoy is taking messy real-world input and getting reliable output from it, which usually means deterministic checks, good tests, and logs I can actually read when something breaks.
Lately I’ve been working on backend services, security testing, and AI tooling. I’ve shipped several releases and I maintain workflows that run in more than one country. I’m drawn to work where evaluation is taken seriously. A model that looks good in a demo is easy. I want the one that still behaves safely and consistently once real users get to it.
A Rust tool that finds ROP gadgets in x86-64 Linux binaries and chains them automatically into working exploits, instead of you stitching gadgets together by hand.
It solves all 8 ROP Emporium challenges (8/8), and in my benchmarks it ran about 40x faster than angrop on the same targets.
I built it because I’m into binary exploitation and wanted to understand chaining properly, not just run someone else’s script. It’s the security side of my work, next to the AI tooling.
Reads invoices (PDF or image) with a vision model, pulls out the fields and line items, then checks the arithmetic: do the line items add up to the subtotal, does tax plus subtotal match the total.
The part that matters: an invoice that fails any validation check can never be auto-accepted. It goes to a human review queue with the reason attached. In my tests that rule held: zero bad invoices were auto-accepted. Extraction will always make mistakes; the system’s job is to make sure those mistakes get looked at.
Results land in SQLite. Bring your own model: Claude, OpenAI, Gemini or a local one.
Code: https://www.twine.net/signin
A local fuzzer for open-weight guardrail classifiers (Llama Guard 3, Prompt Guard 2). It rewrites and re-encodes prompts in many ways and measures how often the guard gets fooled, per attack family, plus how often it over-blocks harmless text.
Most guardrail tests stop when the classifier says “safe.” WARDBREAKER goes one step further and sends the bypass to the model behind the guard to see whether the attack still does anything.
Finding: 77% of the prompts that flipped the guard didn’t survive the model behind it. So raw “bypass rate” numbers overstate the real risk by a lot, and you need the second check to know which bypasses actually matter.
Zero dependencies, runs fully local.
Code: https://www.twine.net/signin
A drop-in proxy that sits between an app and its LLM provider and checks traffic both ways: prompt injection and PII on the way in, unsafe output on the way out. Point your app at the gateway instead of the provider and nothing else changes.
It fails closed. If a check errors out, the request is blocked rather than waved through.
Measured on my offline test set
That trade-off is why the judge is opt-in. For some apps blocking 1 in 11 normal users is not acceptable, and I’d rather show the numbers than hide them.
Python standard library only, works with OpenAI, Anthropic, Gemini or a local Ollama model.
Code: https://www.twine.net/signin
Give it a company name and it researches the company on the web, then writes a short sales brief: what they do, size, likely pain points, key people, recent signals, and an outreach angle.
The rule I built it around: every factual claim must cite a page the agent actually fetched during that run. If it can’t source something, it has to write “unknown” instead of guessing. A made-up fact in a sales email is worse than a gap.
How it works
Works with Claude, any OpenAI-compatible API, or a local Ollama model. Batch mode turns a list of companies into a folder of briefs.
Ask a code repository a question in plain English and get an answer grounded in the real code, with exact file:line citations you can click and check.
New codebases are slow to learn, and a chatbot that guesses about code you haven’t read is worse than no chatbot. So the whole design is about making the answer checkable.
How it works
Result: recall@5 of 0.92 on my evaluation set, meaning the right chunk was in the top five results 92% of the time.
Python, tree-sitter, embeddings + BM25, any LLM.
Code: https://www.twine.net/signin
The problem. A job board covering Kuwait, Bahrain, Qatar and Oman was paying staff to copy job ads by hand from about 45 Instagram accounts and websites into their site. It was slow, and mistakes went live.
What I built. Two Python bots, running on the client’s Linux server.
Result. On one Oman run the posting bot went through 42 sources and created 82 posts with zero failures. The client now runs it for all four countries.
The bug I’m proudest of fixing. The checker was marking an ad as found whenever a keyword showed up anywhere on the page, so missing ads slipped through. I changed the rule to “confirm only what you can prove, otherwise say unknown” and added tests so it stays fixed.
Stack: Python, OpenAI and Gemini models, Apify, SQLite, Google Sheets API, Laravel REST API, cron on a VPS. About 100 offline tests on the posting bot alone. Client code, so the repos are private; happy to demo on a call.
Built and maintain two production Python bots for a job-listing platform that covers Kuwait, Bahrain, Qatar and Oman. The first creates job posts automatically from Instagram and website sources: it reads each ad (text or flyer image) with a vision model and publishes it through the client's Laravel REST API. The second checks the posts made by the client's data-entry team against the original ad and flags the ones that don't match. I own all of it, from scraping and prompts to deployment on a Linux VPS and the Google Sheets reports the client's team works from. Where the model wasn't reliable enough I added deterministic checks, and the posting bot alone has about 100 offline tests.
Tested web applications and APIs, manually validated findings, and wrote clear reports with production-ready remediation steps. Used tools including Nmap, Burp Suite, and Nessus to support evidence-based vulnerability assessment and reporting.
Delivered a multi-profile browser automation platform with real-time alerts and a Windows desktop app for subtitle metadata migration. Focused on reliable automation and user-facing tooling to support migration workflows.
Final year, expected graduation May 2027.
Post a job and invite Syed, or contact them directly. No hidden commission.
