~/syed-mahi
Syed Mahi
Rust / Go / PostgreSQL | Security & Automation
title: Backend & Systems Engineer
focus: Rust, backend systems, AI automation
location: Dhaka, Bangladesh
journey-start: Independent work since 2023

I build security-conscious software for education, operations, and AI-assisted workflows. My work is strongest where a product needs explicit data boundaries, reliable automation, and honest operational status.

cat about_me.md view case studies read resume

$ cat capabilities.md

# where I create the most leverage

01_secure-backend.yml

Secure Backend Systems

SYSTEMS

I turn messy product requirements into explicit APIs, data boundaries, and services that are easier to verify and operate.

  • >Rust and Go services with typed contracts and clear ownership boundaries
  • >Tenant isolation, authentication, authorization, audit trails, and negative-path testing
  • >Architecture decisions documented with current limits instead of inflated claims
02_workflow-automation.yml

Operational Workflow Automation

OPERATIONS

I replace fragile manual coordination with software that makes state, permissions, and recovery paths visible.

  • >Education, scheduling, reporting, inventory, and internal operations workflows
  • >Idempotent jobs, preview-first execution, integrations, and human recovery paths
  • >Product decisions shaped by the people who actually run the process
03_ai-assisted-execution.yml

AI-Assisted Execution

AI / AUTOMATION

I use AI where it improves a workflow, then add structure, validation, and repair around probabilistic output.

  • >Structured generation instead of unbounded text-only prompts
  • >Document ingestion, retrieval, repair loops, and human-in-the-loop review
  • >A bias toward observable, replaceable automation rather than magic demos

$ cat proof-points.json

# the evidence behind the positioning

proof-points.json
design-focus
Trust boundaries
RLS, authenticated transport, and audit trails
backend
Rust / Go
implemented APIs, SQL, and negative-path tests
domains
education / ops
products shaped by real user constraints
release-status
Explicit limits
CI failures and unfinished pilots stay visible

$ tree ~/projects --dirsfirst

# current systems, shipped products, and selected work

Current Systems

The projects that best represent my current backend, security, and architecture direction.

4 projects
~/projects/current-systems/vendryx-commerce

Vendryx Commerce

[SYSTEM]

A Rust/PostgreSQL multi-tenant commerce platform with merchant administration, storefronts, and a partially completed operator control plane.

problem:
How can merchants share an application and database without relying solely on application-level tenant filters?
architecture:
Modular Rust services, PostgreSQL FORCE ROW LEVEL SECURITY, transaction-scoped tenant context, and separate storefront/admin frontends.
proof:
Source migrations implement fail-closed tenant policies; integration and release gates exist, but the latest available CI runs failed.
role: Product & Backend System Builder
RustPostgreSQLRLSTypeScriptDocker
  • -> FORCE RLS and tenant-context checks are implemented in SQL migrations, not just specified in documents
  • -> Commerce phases are marked complete internally, but the transitional control plane is unfinished
  • -> No verified live merchant adoption or successful current CI run is claimed
view case studyprivate repository
~/projects/current-systems/hall-security

Hall Security

[SYSTEM]

A Rust-based research instrument for hall-entry identity verification and security monitoring, deliberately constrained to observe-only behavior.

problem:
How can a security-monitoring prototype collect identity evidence without being trusted to actuate a physical access control?
architecture:
Rust services for vision, control, dashboard, and shared types; PostgreSQL, mTLS, hash-chained audit, and a disk-backed outbox.
proof:
Rust event-delivery code, observe-only invariants, and security gates exist. Latest CI and GPU release qualification remain unresolved.
role: System Designer & Builder
RustTypeScriptPostgreSQLmTLSHash ChainDocker
  • -> Separates observation from actuation: it cannot open doors or grant access
  • -> Uses TLS/mTLS, shared Rust types, audit records, and a disk-backed outbox
  • -> Includes invariant tests, generated TypeScript types, and documented release blockers
  • -> Research prototype: thresholds remain uncalibrated and a qualified release is outstanding
view case studyprivate repository
~/projects/current-systems/logbook-institution

LogBook Institution

[SYSTEM]

A Go and Next.js academic LMS/ERP foundation exploring Moodle-scale institutional workflows with explicit tenant boundaries and a modular backend.

problem:
How can a large academic workflow be decomposed into a maintainable backend without weakening tenant boundaries?
architecture:
Go with chi and pgx, PostgreSQL migrations, JWT-derived organization context, and a Next.js application surface.
proof:
JWT rejection tests, modular Go APIs, and SQL migrations exist; the latest visible CI run failed and the teaching core remains incomplete.
role: Backend Architect & Builder
GochipgxNext.jsPostgreSQLJWT
  • -> JWT middleware tests cover invalid claims, expiry, signatures, and authorization states
  • -> Derives org_id from verified JWT claims rather than trusting request bodies
  • -> Uses tenant isolation tests and negative-capability tests for security-sensitive paths
  • -> An August 2026 project audit says the teaching core cannot yet run a university semester
view case studyprivate repository
~/projects/current-systems/logbook-professor-workspace

LogBook Professor Workspace

[SYSTEM]

A multi-tenant classroom-management SaaS and educator workspace built around RLS, offline-first synchronization, and operational workflows.

problem:
How should educator workflows behave when organization boundaries and low-connectivity synchronization are both non-negotiable?
architecture:
Next.js and React with Supabase/PostgreSQL, org_id-based RLS, PowerSync, and property, security, and load tests.
proof:
A private repository with explicit tenant rules, offline-first direction, and tests around security and synchronization behavior.
role: Product Builder
Next.jsReactTypeScriptSupabasePostgreSQLPowerSync
  • -> Models academic work across organizations with org_id-based data boundaries
  • -> Combines RLS, offline-first sync, and property/security/load testing
  • -> The repository is private; the public story focuses on architecture and trade-offs
view case studyprivate repository

Products & Tools

Tools and products; maturity and current limitations differ by project.

3 projects
~/projects/shipped-products/ipe24-classroom

IPE-24 Classroom

[PRODUCT]

A class operating system that centralizes announcements, schedules, resources, and AI-supported student workflows for an active academic community.

problem:
How can one student batch replace fragmented chat threads, drive links, routine changes, and repeated questions with a dependable source of truth?
architecture:
Next.js, PostgreSQL, Prisma, Redis, Telegram automation, and FastAPI-backed workflow support.
proof:
Built for a university cohort; the reported 60+ student users are not independently verified analytics.
role: Founder, Product Designer, Full-Stack Builder
Next.jsPostgreSQLPrismaRedisTelegram BotFastAPI
  • -> A major product that deepened my software-building focus in June 2025
  • -> Reported use by 60+ students; independently audited usage metrics are unavailable
  • -> Shows end-to-end ownership: problem discovery, product decisions, deployment, and iteration
view case studyprivate repository live
~/projects/shipped-products/email-automator

Email Automator

[PRODUCT]

A Gmail-based bulk email tool for personalized announcements, grades, and reports with preview-first safety and structured data merging.

problem:
How can an operator send sensitive personalized messages at scale without trusting a blind batch or a third-party mail database?
architecture:
Next.js and NextAuth around Google OAuth, Gmail API delivery, CSV normalization, and Handlebars templates.
proof:
Public source implements OAuth-based Gmail sending and preview. Its import endpoint has unresolved authorization and retention concerns.
role: Product Builder
Next.jsNextAuthGoogle OAuthGmail APIHandlebars
  • -> Treats high-stakes sending as a reviewable workflow rather than a blind batch job
  • -> Merges messy CSV data into deterministic recipient workflows
  • -> Uses delegated Gmail sending; the import-data path remains a documented security limitation
view case study source live
~/projects/shipped-products/slidecrafter-ai

SlideCrafter AI

[PRODUCT]

A local-first AI presentation compiler that turns raw context into structured, editable decks with validation and repair around model output.

problem:
How can probabilistic model output become a valid, editable PowerPoint without trusting the model to control every layout detail?
architecture:
React, TypeScript, and Vite around a structured intermediate representation and deterministic PptxGenJS compilation.
proof:
A public compiler workflow with validation and bounded repair before deck export.
role: Product Builder
ReactTypeScriptVitePptxGenJSGemini
  • -> Frames deck generation as a compiler pipeline instead of prompt-only text generation
  • -> Validates layout structure before export and supports bounded repair loops
  • -> Keeps the final compilation step close to the user for fast iteration
view case study source live

Selected Products

Earlier builds that show product judgment, domain range, and the path toward deeper systems work.

3 projects
~/projects/selected-products/the-matrix-hours

The Matrix Hours

[SELECTED]

A watch storefront shaped around curated inventory, owner-friendly operations, and a low-friction WhatsApp buying flow.

problem:
How can a small high-trust seller publish curated inventory without inheriting heavyweight commerce operations too early?
architecture:
Next.js and React with Google Sheets as the operator-friendly inventory source and WhatsApp as the buying handoff.
proof:
A shipped storefront aligned to the seller's current process rather than a generic ecommerce template.
role: Product Builder
Next.jsReactGoogle SheetsWhatsApp Checkout
  • -> Uses a normalization layer around Google Sheets instead of forcing heavyweight commerce infrastructure
  • -> Balances trust-building presentation with operational simplicity
view case studyprivate repository live
~/projects/selected-products/tutors-hub

Tutors Hub

[SELECTED]

A tutoring marketplace designed as a workflow system, with matching, verification, routing, and human recovery paths.

problem:
How can a tutoring request move through changing requirements, verification, matching, and payout without losing operational context?
architecture:
Next.js for product surfaces, Spring Boot for workflow ownership, PostgreSQL/Supabase for relational state, and Firebase notifications.
proof:
Workflow specifications and private implementation exist; the currently deployed feature set has not been independently validated.
role: Product Builder
Next.jsSpring BootPostgreSQLSupabaseFirebase
  • -> Models matching and verification as business state transitions
  • -> Separates onboarding UX from security-sensitive backend workflows
  • -> Makes operational recovery part of the product rather than an afterthought
view case studyprivate repository live
~/projects/selected-products/krishi-dristi

Krishi Dristi

[SELECTED]

An offline-first agricultural intelligence prototype exploring crop issue detection under fragmented-farm and low-connectivity constraints.

problem:
How can crop intelligence work for fragmented plots when connectivity, hardware, and field assumptions are all constrained?
architecture:
Python, OpenCV, TensorFlow, and MobileNetV2 experiments designed around local processing and later synchronization.
proof:
A constraint-driven prototype that documents what remains unvalidated instead of presenting a notebook as a deployed service.
role: Prototype Builder
PythonOpenCVTensorFlowMobileNetV2
  • -> Starts from field constraints instead of assuming reliable connectivity or uniform plots
  • -> Combines classical vision and ML experiments where each is useful
  • -> Clearly remains a prototype rather than a production agricultural product
view case studyprivate repository

$ cat skills.json | jq '.evidence'

# tools connected to work I can point to

skills/backend-data

Backend & Data

Rust// Typed edge/control services, event delivery, and domain APIs
Go// JWT authorization middleware, modular API handlers, and explicit SQL via pgx
PostgreSQL / SQL// Migrations and FORCE ROW LEVEL SECURITY tenant policies
TypeScript / Next.js// Full-stack interfaces and integration-heavy workflows
skills/security-reliability

Security & Reliability

Authentication & tenancy// JWT rejection tests, per-tenant context, and authorization boundaries
mTLS & audit// Authenticated edge communication and tamper-evident event records in a research prototype
Delivery recovery// Disk-backed event outboxes, retry/backoff, and dead-letter handling
Testing// Unit, invariant, integration, and negative-path tests; some current CI checks still fail
skills/infrastructure-integration

Infrastructure & Integration

Docker / Linux// Containerized service workflows and deployment scripts
GitHub Actions// Build, verification, security, and release workflow definitions
OpenAPI / typed contracts// Service contract boundaries and generated dashboard types
Gmail API / OAuth// Delegated send workflow in a public app; import endpoint needs remediation
skills/applied-automation

Applied Automation

Workflow design// Deterministic transforms, human review, and failure recovery
LLM integrations// AI-assisted education and operational tools; business outcomes not independently audited
Computer vision// Rust detection/tracking and identity event association in Hall Security research

$ find './case-studies' -name '*.md' | sort

# technical evidence, trade-offs, and current limits

~/case-studies

Read the deeper write-ups for product context, architecture, security boundaries, difficult decisions, verification, and the work that remains. The goal is to make the engineering evidence inspectable—not to make every project sound finished.

$ cd ./case-studies && ls -la _

$ cat contact.sh

# open to backend systems, automation, and difficult product problems

contact.sh

# If you need someone who can move from ambiguous workflow to a tested, explainable system, reach out.

mail info@syedmahi.meopen https://github.com/syedmahi-dev
# Include project scope and technical constraints when reaching out.