Software Engineer · Damascus, Syria
I build the systems behind software people depend on.
For the past two years I've built the backend of Darkmon, a threat-intelligence platform used by banks and governments. I write the crawlers, pipelines and APIs that turn the dark web into customer alerts. On my own time I build Arabic-first products: tools for Syrian pharmacies, clinics and gyms, plus paid client work running in Egypt today.
I build the engine of a threat-intelligence platform used by banks and governments.
Darkmon watches the clear, deep and dark web for a company's leaked data. Two years in, the platform's biggest features are mine, end to end: from the crawlers to the APIs.
Code-leak monitoring
Scans GitHub, GitLab, DockerHub, NPM and Gist around the clock for customers' leaked code and secrets. A 60-day discovery window, rolling re-checks all day, and a daily full sweep.
Social-media impersonation monitoring
Watches 9 platforms, from Facebook and Instagram to Telegram and Discord, for accounts impersonating a customer's brand or executives: username permutations, Unicode look-alikes and more.
Cortex XSOAR pack · live on the Palo Alto Marketplace
An end-to-end Darkmon pack for Cortex XSOAR and XSIAM: playbooks, automations, two integrations, incident types and layouts that wire Darkmon into a customer's SOC.
cortex.marketplace.pan.dev/
MISP integration
Heavy, messy IOC feeds come in from many sources. I normalize, enrich and structure them so the security team can actually work: sort, filter, search, export.
Global search
One search across the entire corpus: every leak, account, mention and indicator the platform holds.
MISP
Built for paying clients, running today.
Two products that real businesses paid for and use. I built them and I keep them running.
A bilingual POS for car-parts merchants, sold and in daily use.
A real merchant runs his trade on it. The point of sale works fully offline on encrypted SQLite and syncs to a Spring Boot + PostgreSQL server when the line comes back: multi-tenant, JWT auth, hardware-locked licensing, and ledgers that freeze the exchange rate on the day of each sale. The backend, the app, the tests and the deployment are my work.
A software company's web presence, built and run end to end.
LibraSoft (Egypt, est. 1997) sells accounting ERPs across the Arab world, and their site was an old static page. I rebuilt it: Next.js front end, Convex backend, an admin dashboard with a blog CMS, a clients page and a contact inbox. Arabic first, RTL, and I ship every release myself.
Away from Darkmon, I ship Arabic-first products for Syria, alone.
Design, front end, backend, database, installer. The whole stack. Every one is offline-first and encrypted, because here the power cuts for hours a day and the internet is never a given. Real tools for pharmacies, clinics, gyms and shops.
A pharmacy that runs its whole counter with the internet switched off.
Saydaliti is an offline-first Windows app: batch-and-expiry inventory with FEFO dispensing, POS with thermal receipts, prescription verification and a controlled-substance register. All Arabic RTL, all encrypted at rest.
A doctor's whole practice on one encrypted, offline machine.
Eiadati runs patients, visits and prescriptions with multi-currency billing in SYP and USD, specialty templates (including an ophthalmology eyeglasses-Rx grid), and clean A5 letterhead printing. No account, no cloud.
The gym's front desk: QR check-in, cash drawer, automatic reminders.
NABAD handles members with QR cards, subscriptions with freeze/renew, one-tap check-in, cash-drawer reconciliation and who-owes tracking, plus automatic Telegram renewal reminders. Fully offline, per-device licensed.
An Arabic-first ERP that keeps selling through the daily power cut.
ShamSmart is a dual-database, offline-first business system: one Spring Boot core runs on SQLite standalone or PostgreSQL across a LAN. Barcode-first POS, accounting, warehouse, plus a separate web portal that mints machine-locked software licenses.
Things I built for my own daily use.
A disciplined trading bot that knows when to stop.
A self-auditing spot bot on a custom Python sidecar wired into Freqtrade, with a re-armable kill-switch ladder and a zero-dependency dashboard that sums up the live run in one plain sentence for a non-technical owner.
My IPTV subscription on the TV: ad-free, remote-first.
An Android TV app in Jetpack Compose that plays an Xtream-Codes subscription (live TV, movies and series) behind a 10-foot interface. The Room-backed catalog stays memory-flat across 100k+ items on cheap TV boxes.
Small tools I open-sourced.
Backend at the core, full-stack where it's needed.
I'm a software engineer in Damascus. By day I build Darkmon's backend: crawlers, pipelines, global search and APIs for a threat-intelligence platform. By night I build whole products alone, because the tools my city needs don't exist and can't be bought here. Some of it is client work: a POS sold to a parts merchant, and a company site I run end to end.
That mix forces the details most people skip: offline first, encrypted at rest, safe through power cuts, with Arabic and English as equals.