Welcome to

Mirza Portfolio

Backend engineer · Node.js · TypeScript · PostgreSQL

I build production backends: multi-tenant APIs, payment and payout flows, and LLM pipelines that verify every citation before they publish.

Scroll to follow the request

Physics lab

Spacetime Kerr · GR A spinning black hole in Einstein's general relativity, computed from its exact equations. Hayward (theory) A black hole with no singularity at its centre. It does not spin. Wormhole (theory) A tunnel to another universe, with no horizon. It needs negative energy, which nobody has seen.

Core size ℓ 0.60 M Past 0.77 M the horizon disappears and light passes through the core. Past 0.95 M the shadow goes too.

Spin a = J/M 0 · Schwarzschild Not spinning: a round shadow and the coolest disk. 0.6 · Gargantua The spin Interstellar showed on screen. 0.998 · Thorne limit Close to the fastest spin possible: a flattened shadow and a hotter, bluer disk.

Doppler shift and beaming The side of the disk moving toward you looks brighter and bluer. Interstellar left this out.

Software Engineer · ATMEZ AI Solutions · Apr 2025 – Present

Work experience

Four production backends in eighteen months: one as the primary engineer, one co-led.

Mar 2026 – Present · Primary backend engineer

GiGwala Two-sided workforce marketplace

A marketplace where employers hire, track and pay shift workers. I architected the backend that serves its employer web app, worker mobile app and admin dashboard: multi-tenant, role-secured APIs with tenant isolation taken from the token rather than the client, bank and identity data encrypted to OWASP standards, and Razorpay payments and payouts with idempotent, signature-verified webhooks. Attendance is QR- and geofence-checked and drives each job through its lifecycle automatically.

NestJS · TypeScript · PostgreSQL · Prisma · Redis · BullMQ · Socket.IO · Razorpay

Apps on one backend

3

Automated test suites

100+

Of 578 commits

~327

gigwala.com
Aug 2025 – Sep 2026 · Sole owner of the AI Industry feed, team of 6

News Briefs AI news aggregation and generation

An autonomous AI-industry news feed I owned end to end: hourly discovery across publishers, evidence fetching and primary-source tracing, then generation with Gemini. Every citation is fetched and confirmed before publish, so a fabricated link can't ship. I rebuilt the extraction pipeline to parse each page once, made IP-blocked publishers readable, and cut the cost of each published article by benchmarking models on the live path.

Node.js · LangChain · Gemini · Playwright · JSDOM · DOMPurify · Prometheus

Publisher sources

60

Less pipeline memory

70–80%

Parse throughput

3–4×

News Briefs API
Jan 2026 – Mar 2026 · Co-led backend, team of 4

Acadlynk Multi-tenant school management SaaS

One platform running many schools. I bootstrapped and co-led the backend: separate API portals for each kind of user, generated from a single source so each client sees only its own surface; an automatic timetable engine that rejects double bookings; fee management and PDF report cards; and query work that removed N+1 lookups and added cursor pagination.

NestJS · TypeScript · PostgreSQL · Drizzle ORM · Swagger

REST endpoints

200+

Role-scoped portals

4

Commits

148

acadlynk.com
May 2025 – Jan 2026 · Backend engineer

Atruha Finance Tadawul stock analysis

A stock-analysis platform for the Saudi market. I designed the valuation, estimation, contract-management and company-report systems from scratch; built a bilingual English/Arabic reporting engine that turns uploaded Excel statements into localized API responses; and shipped a DCF valuation service with per-user quotas, behind CI/CD with health checks, automated backups and rollback.

Node.js · Express · MySQL · GitHub Actions

Commits

485

Pull requests merged

215

Report languages

EN · AR

atruhafinance.com

Problems worth asking about

POST /api/v1/timesheets/search · signed in as t_acme

body.tenant_id

Scope rows from token body

KYC dedupe · blind index

Document number (sample)

Flip the scope to body to see the bug this rules out. The index is a keyed SHA-256 made in this tab, so a duplicate is found without decrypting a row.

citation guard · before any fetch

Cited URL

The browser's own URL parser runs first, so disguised hosts arrive normalised. Names are resolved on the server and every address passes the same test.

cost per published article

Length-gate pass · model A Length-gate pass · model B

Price and latency per generation are the measured numbers. Pass rates are yours to set: retries until a draft passes are geometric, so each published article costs c / p and takes t / p.

C++23 · Qt 6.8 · CMake 4.0

Reqloom

Postman is an HTTP client. Reqloom is an API workflow engine.

Describe each actor and endpoint once in YAML, with its prerequisites. Reqloom builds the dependency graph, sorts it, and runs the whole chain from one command: logins, prerequisite calls, then the target, with extracted IDs passed along automatically.

Tests passing: 852
Full suite: 7.2 s
Release platforms: 3
Lines of C++ & QML: ~80k

Describe each actor and endpoint once in YAML, with its prerequisites. Reqloom builds the dependency graph, sorts it, and runs the whole chain from one command: logins, prerequisite calls, then the target, with extracted IDs passed along automatically.

Decisions worth asking about

The UI boundary is enforced three times

A CMake link guard, a CI grep gate and a pImpl-only public header surface keep the engine free of Qt UI code. Architectural rules that no machine checks tend to decay.
One error vocabulary

Every public entry point returns std::expected<T, ErrorCode>. Parallel error enums are banned, so a new failure mode extends one list, with is_retryable() built in.
CI down from 45–90 minutes to 10–15

Building Qt from source through vcpkg blew past the free runners' 60-minute cap. Switching to pre-built, signature-checked aqtinstall artifacts fixed it. A dependency choice made on measured cost, not preference.

Source on GitHub Documentation

resources/refunds.yaml

approve:
  method: POST
  path: /api/v1/admin/refunds/{{refund.refund_id}}/approve
  actor: admin
  depends_on: [refund.request]
  expect_status: 200

The whole declaration. One dependency, and the actor it runs as.

terminal

$ reqloom run refund.approve
Loaded project: MarketplaceAPI (3 actors, 5 resources)
Running: refund.approve (chain of 7 steps, env=local)
  [1] Running: product.create (attempt 1)
  [2] Running: product.publish (attempt 1)
  [3] Running: cart.add_item (attempt 1)
  [4] Running: order.create (attempt 1)
  [5] Running: order.pay (attempt 1)
  [6] Running: refund.request (attempt 1)
  [7] Running: refund.approve (attempt 1)
Result: SUCCEEDED

One command, seven requests in dependency order, across three actors. Nobody wrote the order: it falls out of depends_on and {{…}} references, and three cached logins cover all seven steps.

TypeScript · React 19 · Bun · MongoDB · Tauri

Memento

A notes and credentials vault where the server only ever sees noise.

Everything is encrypted on the device with libsodium (XChaCha20-Poly1305, keys derived with Argon2id) before it leaves. Plaintext and keys never reach the server. One TypeScript monorepo ships a React web app, a Bun/Express API, a Tauri desktop app and a browser extension.

Clients, one monorepo: 4
REST route groups + GraphQL: 27+
Plaintext on the server: 0 B

Everything is encrypted on the device with libsodium (XChaCha20-Poly1305, keys derived with Argon2id) before it leaves. Plaintext and keys never reach the server. One TypeScript monorepo ships a React web app, a Bun/Express API, a Tauri desktop app and a browser extension.

Real-time sync without giving up encryption

Socket.io and MongoDB Change Streams move encrypted changes between devices; Yjs CRDTs resolve collaborative edits automatically.
Offline first

Encrypted local cache in IndexedDB (Dexie) and a PWA service worker, so the vault opens without a network.
Serious about sign-in

WebAuthn passkeys, TOTP two-factor, Google OAuth, rate limiting and a tamper-evident audit log.

Live app Private repository, walkthrough on request.

server · notes collection

{
  "_id":        "note_q3-launch",
  "v":          1,
  "iv":         …,
  "ciphertext": …,
  "tag":        …,
  "updatedAt":  …
}

Everything the server holds. Illustrative row, real bytes: sealed in this tab from the password you type above, with a key that never leaves it.

your device · decrypt

$ open(key, row)
…

An attacker who edits the row gets an error, not a different password.

Python 3.10+ · SQLite · Published on PyPI

PaperTrade‑India

No Indian broker offers a paper-trading API, so I built the broker.

An installable package that simulates NSE and BSE execution the way it actually hits your P&L: statutory fees (STT, GST, stamp duty, SEBI charges), T+1 settlement, tick, lot and price-band rules, slippage and market impact, behind an Alpaca-style API.

Tests, incl. property-based: ~540
Market-data providers: 15+
Order types, full OCO: 5

An installable package that simulates NSE and BSE execution the way it actually hits your P&L: statutory fees (STT, GST, stamp duty, SEBI charges), T+1 settlement, tick, lot and price-band rules, slippage and market impact, behind an Alpaca-style API.

from papertrade_india import IndiaPaperBroker

broker = IndiaPaperBroker(initial_capital=1_000_000)
order = broker.buy("RELIANCE", 10)
print(order.filled_avg_price, order.fees_paid)

Data that fails over instead of falling over

Per-provider circuit breakers, median aggregation across sources and a first-wins failover feed.
A ledger that can't drift

Thread-safe SQLite in WAL mode, versioned migrations, idempotency keys and an immutable cash ledger with an invariant check, verified by Hypothesis across generated inputs.
Built for agents too

An optional MCP server lets LLM agents trade through tool calls.

Source on GitHub PyPI package Simulated broker. Places no real trades.

More work

SnapHaul

Swift · C · libusb

Native macOS–Android file transfer. A custom MTP stack in C, a four-stream ADB engine, checksum-verified automated ingest and Finder integration. No Electron.
Aereo

Swift 6 · AVFoundation · SwiftUI

Hardware-accelerated video wallpapers for macOS, including lock-screen video through user-space Aerial manifest injection. Signed, notarized and on Homebrew.
EMERGENCE

Python · Textual

Artificial life in the terminal: creatures with neural-network brains learn by reinforcement and evolve by genetic algorithm.
Terminal Theatre

Python

An ASCII noir game with branching stories: 84 scenes, 60+ choices, 23 endings.

Contact

Enough HTTP. Let's switch to a conversation: email is the fastest way to reach me.

GET /api/v1/mirza-portfolio/contact · Upgrade: human 101 · sealed

email: mirzamunawardev@gmail.com
github: github.com/Mirzabaig313
linkedin: linkedin.com/in/mirza-munawar
based_in: Telangana, India

Mirza Portfolio

GiGwala Two-sided workforce marketplace

News Briefs AI news aggregation and generation

Acadlynk Multi-tenant school management SaaS

Atruha Finance Tadawul stock analysis

Problems worth asking about

Decisions worth asking about

The UI boundary is enforced three times

One error vocabulary

CI down from 45–90 minutes to 10–15

Real-time sync without giving up encryption

Offline first

Serious about sign-in

Data that fails over instead of falling over

A ledger that can't drift

Built for agents too

More work

SnapHaul

Aereo

EMERGENCE

Terminal Theatre

Contact