Software engineer · Security Researcher
I'm Mahmoud. I design, build, bill, and support complete products: web, iPhone, native macOS, agent tooling.
Third espresso, probably.
Security reviews
Paid security reviews for mobile and web apps: verified findings, practical fixes, and a free re-test once you have shipped them. The process is the one from my public research, and it is documented in the open.
Products, research, and tools. Everything here is live, open source, or both, and all of it was designed, built, and shipped by me alone.
Every shot,
dialed in
Brew log,
always on
An AI-first editor for App Store screenshot sets. The agent drives the same canvas operations you would use by hand, so every text layer, gradient, and device mockup stays a real, editable element. No account, no backend, bring your own key.
Every Kleine Anfrage from the official Bundestag API: searchable, filterable, with MP statistics and an AI chat that answers from the documents and cites its sources.
Hi Lena, quick update on the beta:
Push-to-talk dictation from the menu bar, with AI cleanup and formatting that adapts to the app you are speaking into: an email reads like an email, code reads like code.
Server-side analytics for Shopify. Sessions, referrers, and conversions tracked where ad blockers cannot reach, with Meta Conversions API and event deduplication built in.
captured server-side
→ pageview · ref instagram
→ add_to_cart · session 8f3a
→ purchase · Meta CAPI, deduplicated
The excavator phase.
Built as a father first, engineer second.
My son is autistic. A structured journal changed how we understand his days: what helps, what overwhelms, what the doctors actually need to hear from us.
Noah is that journal, built properly and named after him. The core is free and stays entirely on your phone. Other parents should not have to build their own.
I ran production systems long before I ran agents.
2018 - 2022
Ministry of Finance NRW
Four years of tax law and administrative procedure. Where I learned how systems with real stakes work, and how they fail.
2022
KISTERS
Enterprise Java EE for public-sector administration. Production systems with real users and zero appetite for breakage.
until 2025
K.A.Y. Security Service
Sole architect of every system the company ran on: web, mobile, database, infrastructure. Concept to deployment, alone.
since Dec 2025
zachi.dev
Everything under Selected work, shipped in months. Agents are the multiplier; the engineering underneath is mine.