full-stack developer · noida, india
I build tools I actually want to use.
BCA student at Galgotias University. I started with a plain HTML page in early 2025 and have been going deeper ever since — React, Next.js, FastAPI, PostgreSQL, concurrency control, offensive security — things that actually ship, and that I can prove work.
Selected work
A clinic appointment booking system built around one hard problem: when two patients try to book the same doctor's slot at the exact same instant, exactly one of them wins — proven, not just claimed. JWT auth with role-based access control enforced at the query level, rate-limited login, atomic audit logging, and async reminder jobs.
The core guarantee rests on two independent layers — Postgres row-level locking
(SELECT ... FOR UPDATE) plus a database unique constraint as a hard backstop —
and it's backed by three levels of proof: a manual concurrent-request test, an automated
pytest regression test that runs in CI against a real Postgres service container, and a k6
load test firing 30 simultaneous booking requests at the same slot (100% correct outcome
across all three). The Next.js frontend keeps the JWT server-side only, behind httpOnly
cookies and route handlers, so it never touches client-side JavaScript.
A full-stack developer activity tracker — a FastAPI + PostgreSQL backend behind a React + TypeScript frontend, deployed as two independently running services rather than a single bundled app.
Getting this deployed was its own lesson in production debugging: a multi-day Railway
deployment failure traced back to a Custom Start Command set in the Railway UI silently
overriding the project's own Dockerfile — the kind of platform-config gotcha that never
shows up in a tutorial and only surfaces once you're running real infrastructure instead
of npm run dev.
A notes app I built securely from scratch, then deliberately broke — reintroducing five real vulnerabilities (SQL injection auth bypass, IDOR, stored XSS, plaintext password storage, a hardcoded secret) one commit at a time, exploiting each manually, and writing up the findings in a professional penetration-test report.
Most beginner security portfolios test somebody else's pre-broken app. This one shows both sides — the exact secure code that existed before, and the exact commit that broke it — then walks through proof-of-concept exploitation and remediation the way a junior VAPT analyst would report it to a client. The hardening decisions in SecureSlot (UUID keys against IDOR, bcrypt over SHA-256, rate-limited login) trace directly back to vulnerabilities found here.
Paste code in any of 22 languages and get a structured review — bugs, security issues, performance problems — broken into categories with severity badges and concrete fix suggestions. Results stream live as the model generates them.
The interesting part wasn't the AI integration. It was getting Gemini to consistently return parseable JSON across minified and broken inputs, implementing real SSE streaming with buffer handling for split chunks, and building the health score ring in plain SVG with no charting library.
What I work with
Languages
Frontend
Backend
Data & Infra
Tools & Platforms
AI & APIs
Testing & Security
Background
I'm a BCA student at Galgotias University, Greater Noida. I built my first portfolio page in February 2025 — plain HTML, nothing fancy. Since then I've been pushing myself into progressively harder problems: concurrency control, offensive security, streaming APIs, auth architecture — building things from scratch instead of reaching for a library.
Every project here started from a real problem, not a tutorial. SecureSlot exists to prove — not just claim — that a booking system won't double-book under real concurrent load. Vault Notes VAPT exists because I wanted to understand vulnerabilities from the side that introduces and exploits them, not just the side that patches them after a scanner flags them — and that hands-on offensive work directly shaped how I hardened SecureSlot. The AI Code Reviewer exists because every AI coding tool I'd used was just a chatbot with no structure.
My CS foundation is in C++ and Java, data structures, algorithms, the fundamentals. My build stack is JavaScript/TypeScript and Python. I care about what's underneath the UI row-level locking under concurrent writes, consistent JSON from an LLM, buffer handling in SSE streams, a JWT that never reaches client-side JavaScript. Currently building in public — GitHub has everything recent.