• Built the Flutter participant client against a tenant-scoped API — badge, ranked matches with explanations, meeting booking, messaging and agenda — sharing one design-token system with the web surfaces so brand changes propagate to both from a single source.
• Architected the platform end to end: a Laravel 13 / PHP 8.3 API with 27 bounded domains and 118 migrations, queued ranking pipelines, Stripe billing, and a CI gate running static analysis at level 8 plus a dedicated tenant-isolation test suite across 1,570 tests.
• Enforced entitlement gating server-side after finding four features gated in the client alone — the mobile client hardcodes its tabs, so server-side authorisation is what actually protects it. Unknown entitlement keys now fail closed instead of open.
• Shipped a full brand re-theme across five surfaces in one pass — design tokens regenerated to CSS/TS/Dart, synced into the Flutter app, with a dark-mode primary lifted from a failing 3.41:1 to a compliant 5.13:1 contrast ratio.

Tech: Flutter/Dart, design tokens (Dart/CSS/TS pipeline), Laravel 13, MySQL, Redis, WebSockets, Stripe, Next.js, GitHub Actions.

• Owned end-to-end delivery of authentication, payments and platform reliability across a large cross-platform codebase, operating server-authoritative alongside backend, design and QA teams.
• Shipped a complete passwordless authentication system: passkey registration and login (WebAuthn/FIDO2) with OTP fallback (email / Google Authenticator) and step-up re-authentication for sensitive actions.
• Built a passkey-first verification service acting as the central orchestrator for all sensitive flows, with per-device credential management and multi-OEM/iOS hardening.
• Implemented idempotency across 15+ money-moving flows to prevent duplicate transactions, and integrated intent hashing — canonical SHA-256 over amount, recipient, currency and path — binding and tamper-protecting each transaction from prompt to execution.
• Engineered client-side transaction safety: payload-freeze snapshots, double-submit guards, and on-device transaction lifecycle tracking with persistence and crash recovery for in-flight transactions.
• Delivered deposit, withdrawal, transfer, exchange, buy/sell and virtual/physical card flows from conception to completion, alongside core wallet functionality including balances.
• Constructed the real-time layer using WebSockets for live transaction status and streaming data, with connectivity-aware reconnection.
• Hardened the Dio API layer with typed error handling, encrypted requests, request signing and strict logging hygiene (no tokens, balances or PII).
• Led an app-wide design system (spacing, colour, typography tokens, full light/dark theming) migrated across 250+ files; centralised typed navigation and maintained 7-locale internationalisation.
• Built the CI/CD pipeline from scratch — signed builds, secure keystore management, release hardening and obfuscation; co-owned iOS and Android store deployments and release sign-off with QA.

Tech: Flutter/Dart, GetX, Dio, WebSockets, REST, secure storage (Keychain/Keystore), native iOS/Android, GitLab CI/CD.

• Architected a Flutter application of roughly 680 Dart files and 109k lines, alongside a Laravel REST API, Node.js Socket.IO real-time server and Next.js admin dashboard.
• Built real-time, location-aware features: live GPS geofencing with server-validated entry/exit, live presence and rosters, typing and read receipts.
• Implemented Clean Architecture (domain/data/presentation) with BLoC/Cubit and GetIt DI; shipped FCM push, deep linking, presigned S3 uploads and multi-provider auth.

• Teacher–student learning platform (09–12/2025) — cross-platform Flutter client on Clean Architecture with BLoC: content management, payment flows and role-based access, Arabic RTL localisation, Firebase (Auth, Cloud Messaging, Analytics) and a token-authenticated API layer, built on a shared component library reused across feature modules.
• AqarClick (06–08/2025) — property platform: a Laravel 12 API (100 migrations, Services/Policies/Observers, policy-driven RBAC) with a Node.js Socket.IO real-time tier, plus a React/TypeScript client with Arabic-RTL i18n.
• Rest Fort (10/2023–01/2024) — cross-platform rental client (Bloc + MVVM): real-time chat over the Pusher SDK with delivery and read state, and integration of multiple payment gateways and third-party SDKs.
• Masar (06–07/2023) — React admin panel and a Flutter client against Laravel APIs, keeping web and mobile synchronised on one shared data contract.
• Yumgott (04–05/2023) — restaurant app with Swish payment integration and digital-wallet features, authentication, interactive reels and social features (MVVM + Bloc).
• Nabda Organization (01–02/2022) — data showcase application with server-side form submission and validation, responsive across devices.

Tech: Flutter/Dart, BLoC/Cubit, MVVM, Clean Architecture, GetIt, Dio, Firebase, Pusher, payment gateways, Laravel 12, Node.js/Socket.IO, React/TypeScript, RTL i18n.

• Built an offline-first sync engine on a local Drift database — the app is fully usable with no connectivity, queuing mutations locally and reconciling against a server that stays authoritative on conflict, with server-driven session invalidation.
• Integrated RevenueCat subscriptions behind one canonical billing identity, so entitlement state cannot diverge between device and server or leak between accounts.
• Generated PDF quotes and invoices with full Arabic/Turkish RTL — solving a bidirectional text defect where Latin runs reversed per character on Arabic pages (font fallback split text into one span per glyph), fixed with a script-run text layer and hand-mirrored tables.

Tech: Flutter/Dart, Bloc, GetIt, go_router, Drift, Dio, pdf/printing, RevenueCat, Laravel 13, i18n (TR/AR/EN + RTL).

• Designed date-seeded deterministic generation so every player worldwide receives identical daily puzzles with no server, no accounts and no network calls of any kind — verified by an automated three-year forward sweep in CI.
• Shipped the full retention loop — three escalating rounds, streaks with freeze tokens, mid-round resume, share cards, stats and evening reminders — with a DST-safe day index and golden tests as the release gate.

Tech: Flutter/Dart, deterministic PRNG (splitmix64), local notifications, golden tests.

• CorePlus Academy — a 266-file e-learning client built feature-first (auth, courses, learning, library, orders, teachers) on Clean Architecture with Bloc and Dio, delivered against a written SRS, design-system and API specification.
• «على جبهتك!» — Arabic pass-the-phone party game using device-tilt gesture detection (sensors_plus) for charades-style play, with audio feedback and AdMob monetisation; Bloc state machines covered by 15 test suites.

Tech: Flutter/Dart, Bloc/Cubit, Dio, sensors_plus, audioplayers, google_mobile_ads, Clean Architecture.

• Cumulative average 87.12% — "Very Good"; 162/162 credit hours completed.
• Recognised institution in the German ANABIN database (status H+).
• Advanced coursework: Advanced Software Engineering (97), Advanced Software Design (97), Data Structures (95), Information Security (90), Computer Networks (90), Operating Systems (90), Graduation Project I & II (98/98).

• Architected a domain-driven Laravel 13 / PHP 8.3 API — 27 bounded domains (Identity, Tenancy, Billing, Commerce, Matching, Meetings, Messaging, Privacy, Idempotency, Webhooks, Realtime), 118 migrations and 21 versioned REST route modules behind Sanctum token auth.
• Made tenant isolation an enforced invariant, not a convention: a query-layer bypass guard with an explicit allowlist, tenant-scoped model binding, and a dedicated CI suite — the tenant-isolation matrix — that fails the build on any cross-tenant read.
• Designed the commerce and billing layer as auditable state machines (draft → paid → refunded), with plan quotas that hard-block orders at the limit, a Stripe webhook incident lifecycle (received → open → retrying → recovered) with retry and operator deep-links, and dunning-driven tenant suspension.
• Engineered the matching engine — a weighted multi-feature scorer over embeddings of four row families, explanations generated strictly from the stored feature snapshot so no reason is invented. Diagnosed a production failure serving an empty feed to 2,008 of 2,275 participants: root cause was operational (ranking runs never executed for 45 of 46 editions), not algorithmic. Shipped debounced re-rank queueing on pool change plus score-threshold recalibration.
• Built the async pipeline on queued jobs and cron workers — a profile change fans out to per-tenant projection jobs that re-extract fingerprints and re-queue the embed→rank chain, so an edit genuinely re-ranks instead of going stale.
• Hardened auth and privacy: passwordless magic-link with a constant 202 response (no account-existence oracle), hash_equals token comparison, throttled endpoints, a rotatable unauthenticated ICS feed validated against an independent RFC 5545 parser, GDPR anonymisation, and k=5 cohort suppression so analytics cannot re-identify small groups. Closed a real leak where private feedback escaped an unconstrained eager-load — proven by injecting the exact leak, then blocking it.
• Found and fixed a class of client-only authorisation: four features gated in the frontend alone let a low-tier token read ranked recommendations. Moved enforcement server-side, made an unknown entitlement key fail closed instead of open, and added a tenant-wide budget cap so one caller could not drain the AI quota for everyone.
• Owned the CI/CD security gate — Pint, Larastan level 8 with no baseline, Gitleaks secret scanning, a content-security pattern check and Pest suites (1,570 tests) — and ran production deploys.

Tech: PHP 8.3, Laravel 13, Sanctum, MySQL, Redis, Laravel Reverb (WebSockets), queued jobs & cron workers, Stripe, AWS S3, Pest/PHPUnit, PHPStan/Larastan L8, GitHub Actions, Python ETL, Next.js BFF.

• Owned the money-movement integrity protocol across 15+ transactional flows — deposit, withdrawal, transfer, exchange, buy/sell, virtual and physical cards — implementing idempotency keys that make duplicate submissions safe under retry and network partition.
• Implemented intent hashing: a canonical SHA-256 over amount, recipient, currency and path, binding each transaction from prompt to execution so a mutated payload fails verification server-side.
• Designed the transaction-integrity model with the backend team on a strictly server-authoritative contract — the client displays and forwards, never decides — with payload-freeze snapshots, double-submit guards and crash-recoverable lifecycle tracking for in-flight transactions.
• Integrated passwordless authentication end to end: passkey/WebAuthn (FIDO2) registration and login with OTP fallback and step-up re-authentication for sensitive operations, orchestrated through a single verification service with per-device credential management.
• Consumed the real-time transaction layer over WebSockets with connectivity-aware reconnection; hardened transport with a typed error taxonomy, encrypted requests, request signing and strict logging hygiene — no tokens, balances or PII in any log sink.

Tech: REST, WebSockets, WebAuthn/FIDO2, SHA-256 intent hashing, idempotency keys, request signing, Keychain/Keystore, GitLab CI/CD, Flutter/Dart client.

• Designed and built the Laravel REST API that owns the truth — 44 models, 74 migrations, ~249 endpoints behind Sanctum — with multi-provider auth (Apple / Google / phone), FCM push and deep-link resolution.
• Built a Node.js Socket.IO real-time server that verifies every socket identity against Laravel before fan-out — no client-supplied identity is ever trusted — over a shared-secret internal bridge, replaying room membership on reconnect while preserving nested join order.
• Implemented the real-time modules: presence and rosters, rooms and membership, delivery/read acks, friends and blocks, moderation with user and IP bans, a per-socket rate limiter, structured logging and Sentry.
• Built server-authoritative geofencing — GPS only decides when to ask; the server decides inside/outside via Haversine and is the single source of truth, with transient network errors never ejecting a user, plus location-integrity and anti-bot guards.
• Designed a presigned-upload media contract (presign → PUT → complete) to S3 with multipart fallback: messages carry only a media ID and private objects are served through short-TTL signed URLs, so no media bytes transit the chat pipeline.

Tech: Laravel 12, Sanctum, MySQL, Node.js, Socket.IO, Express, AWS S3, FCM (HTTP v1), Sentry, Next.js 16 admin, Docker.

• AqarClick (06 – 08/2025) — real-estate platform. Built the Laravel 12 / PHP 8.2 REST API (100 migrations, layered into Services, Policies, Observers and Traits, Sanctum auth, policy-driven RBAC) plus a companion Node.js Socket.IO service on a strictly Laravel-authoritative contract — the API persists, then pushes to an internal emit endpoint and the socket layer fans out; clients emit only ephemeral signals (typing, presence, read acks), never state. Added socket auth handshakes, room membership, presence and a per-connection rate limiter with structured logging and Sentry.
• Teacher–student learning platform (09 – 12/2025) — Flutter client on Clean Architecture with BLoC against a token-authenticated API: content management, payment flows, role-based access, Firebase (Auth, Cloud Messaging, Analytics) and Arabic RTL localisation.
• Rest Fort (10/2023 – 01/2024) — integrated multiple payment gateways and third-party SDKs; engineered real-time chat over the Pusher SDK with delivery and read state (Bloc + MVVM).
• Masar (06 – 07/2023) — React admin panel and a mobile client against Laravel APIs, keeping web and mobile synchronised on one data contract. Yumgott (04 – 05/2023) — Swish payment integration and digital-wallet features. Nabda (01 – 02/2022) — server-side form submission and validation.

Tech: PHP 8.2, Laravel 12, Sanctum, MySQL, Node.js, Socket.IO, Express, Sentry, REST, RBAC, Pusher, payment gateways, Flutter/Dart, Firebase, React/TypeScript.

• Containerised async Python service that continuously ingests listings, scores them with an LLM, auto-applies to strong matches and reports through a Telegram bot and dashboard.
• Fully asynchronous data layer — SQLAlchemy 2.0 async ORM over asyncpg against PostgreSQL 16, with Alembic migrations run as a dedicated compose service so schema changes deploy ahead of the app; typed config and validation end-to-end with Pydantic v2.
• Resilient ingestion via httpx with tenacity retry policies and aiolimiter concurrency rate limiting so upstream sources are never hammered; recurring pipelines scheduled with APScheduler.

Tech: Python 3.12, SQLAlchemy 2.0 (asyncio), asyncpg, PostgreSQL 16, Alembic, Pydantic v2, httpx, tenacity, aiolimiter, APScheduler, OpenAI API, Playwright, Docker Compose.

• Built a Laravel 13 REST API with Sanctum auth backing an offline-first sync engine — the client queues mutations locally and reconciles against the server, which stays authoritative on conflict.
• Implemented server-driven session invalidation and one canonical billing identity, so entitlement state cannot diverge between device and server or leak between accounts; RevenueCat entitlements gate Pro document generation.

Tech: PHP 8.3, Laravel 13, Sanctum, REST sync protocol, RevenueCat, Flutter/Dart, i18n (AR/TR/EN + RTL).

• Cumulative average 87.12% — "Very Good"; 162/162 credit hours. Recognised institution in the German ANABIN database (status H+).
• Relevant coursework: Distributed & Cloud Computing, Operating Systems (90), Computer Networks (90), Information Security (90), Data Structures (95), Compilers Design, Data Mining & Data Science, Advanced Software Engineering (97), Advanced Software Design (97), Graduation Project I & II (98/98).