Skip to content

Projects

Built and delivered

Products I have built and delivered, and the AI security project I am working on now.

Delivered

Compliance Gate

EU AI Act compliance checker

A web tool for businesses that build or use AI. It works out what the EU AI Act requires of them, what they need to do to comply, and what it is likely to cost, split into one-time and ongoing spend.

  • EU AI Act obligations
  • Steps to become compliant
  • One-time cost estimate
  • Ongoing cost estimate
EU AI ActAI governanceWeb application
Delivered

Domz.com

A domain name marketplace

A marketplace where domain buyers and sellers find each other and negotiate directly. Sellers list their portfolio, buyers search and message them, and listings carry a fixed fee in place of a commission.

  • Buyer and seller accounts
  • Direct messaging
  • Portfolio listings
  • Domain search
Next.jsMarketplaceWeb application
Delivered

TUSA

An online store for car accessories

An e-commerce store selling car accessories across India, from tyre inflators to dash cameras, with customer accounts, cart, checkout and order tracking.

  • Product catalogue
  • Cart and checkout
  • Customer accounts
  • Order tracking
ShopifyE-commerce
In progress

AI assistant security review

Attacking, securing and governing an LLM application

An enterprise AI assistant with document search and an agent that can call tools, used as a test bed: threat-modelled, red-teamed, secured, then assessed against AI governance frameworks.

  • Threat model
  • Red-team report
  • Risk register
  • Governance assessment
RAGLLM securityOWASP LLM Top 10NIST AI RMF
Delivered

This portfolio

The site you are looking at

Built with Next.js and Tailwind CSS. The contact form validates and escapes every input on the server before it is sent as email.

  • Server-side validation
  • Output escaping
  • Bot honeypot
Next.jsTypeScriptTailwind CSSResend

More of my work

The rest of my projects and background are on LinkedIn, with code on GitHub.

See more on LinkedIn github.com/samiramrullah

Security playbook

How I explain common risks

Six common application risks, each in three layers: how it happens, what it costs and how to fix it.

Broken access control

How it happens
A user changes an ID in a request and reads someone else's record, because the server never checks who owns it.
Impact
Data exposed across accounts, or actions taken with another user's rights.
Fix
Check ownership and role on the server for every request. Deny by default.

SQL injection

How it happens
User input is joined straight into a query, so the input is run as part of the SQL.
Impact
An attacker can read, change or delete what is in the database.
Fix
Parameterised queries, input validation and a least-privilege database account.

Cross-site scripting (XSS)

How it happens
The app puts user input into a page without encoding it, so a script runs in another user's browser.
Impact
Stolen sessions and actions performed as the victim.
Fix
Encode output for its context, add a Content Security Policy and use HttpOnly cookies.

Hard-coded secrets

How it happens
API keys or passwords are committed to source code, where anyone with repository access can read them.
Impact
Direct access to whatever system the secret protects.
Fix
Environment variables or a secrets manager, secret scanning in CI, and rotation of anything exposed.

Security misconfiguration

How it happens
Default credentials, open storage buckets, verbose error pages or missing security headers.
Impact
Easy entry points and information that helps an attacker plan the next step.
Fix
Hardened baselines, reviewed infrastructure settings and regular configuration checks.

Vulnerable components

How it happens
An outdated library with a publicly known vulnerability ships inside the application.
Impact
Attackers reuse exploits that are already published.
Fix
Dependency scanning, an inventory of components and a routine for patching.