LLM builder who finds the vulnerabilities he ships. Information Security graduate, building from Gaza.

LLM-Scanner — an LLM-based source-code vulnerability scanner, built and benchmarked in public.

How it works: deterministic CPG queries (Joern) find source→sink candidates → a slicer extracts the minimal evidence → RAG retrieves similar known advisories (4,095 GHSA entries, pgvector) → a skeptical LLM judge confirms or rejects every finding → SARIF 2.1.0 out.

The numbers, on the OWASP Benchmark (1,478 cases, 47% of them false-positive traps, same scorer for every tool):

• Recall 1.00 across all 4 vulnerability classes — zero missed — matching CodeQL (Semgrep: 0.86)
• The judge kills 51% of false alarms at a 2% true-positive cost (precision 0.50 → 0.67, CI-separated)
• The judge finding that became the story: skepticism matters more than capability — a bigger, paid model confirmed ~90% of everything it saw; the free one actually judged
• Runs entirely on free-tier APIs and local tools

I write the whole build in public — every number, including the ones that started at recall 0.07. Start here: My Scanner Missed 93% of the Bugs — and That Was the Right First Result · full series at dev.to/alimafana

Provia — AI commerce platform where every store gets an AI salesperson that speaks the customer's dialect, respects real stock, and haggles like a merchant. Next.js · Supabase · OpenAI · pgvector. The production lessons from it — AI sycophancy, prompt injection, cost architecture — fill my most-read articles.

• TryHackMe top 2% worldwide — tryhackme.com/p/quber: 145 rooms, Jr Penetration Tester + CompTIA Pentest+ paths
• Every claim I publish has a repo or a benchmark behind it

Security/AI   Python · Joern (CPG) · CodeQL · Semgrep · pgvector · Gemma · OpenAI API · SARIF
Product       Next.js · React · TypeScript · Supabase · Tailwind CSS
Tools         Git · Docker · Claude Code

I build products, then hunt the vulnerabilities in what I built — and publish both halves. Every API I once left unprotected, every prompt injection I caught, every false alarm my scanner raised: documented, measured, shared.

Building from Gaza isn't a limitation. It's a perspective. Every API call counts when you don't know when the power goes out. Every token matters when the budget is your own pocket. That constraint makes you build better software.

Dev.to · LinkedIn · X · TryHackMe

_{Gaza, Palestine}