The short version
I'm Arham Sayyed. I build full-stack apps for a living, break things for fun (and sometimes for money), and teach undergrads how to do both, badly at first, better eventually.
Stack of choice: MERN, Next.js, React Native, TypeScript. If it's not in that list, I've probably still touched it, just less happily.
How I actually got here
I didn't start out planning to split my time between "ship this for a client by Friday" and "why does this SIEM alert look wrong." It happened in the normal messy way: one freelance project led to another, one curiosity about why an app was insecure turned into actually building security tooling, and one guest lecture turned into an ongoing teaching gig I didn't see coming.
Most of my paid work has been freelance and contract: restaurant tech, internal tools, automation that saves someone three hours a week they'll never think about again. The unglamorous stuff, mostly. I like it because the constraints are real: real users, real deadlines, real "wait, why is this endpoint public" moments at 11pm.
The security rabbit hole
The instinct that makes me decent at building software is the same one that makes me decent at breaking it: I don't like taking "it works" at face value. That curiosity eventually turned into contributing to Haxnation's platform engineering. I worked on the backend behind their SOC simulation platform, which maps realistic SIEM alerts and analyst triage workflows to the MITRE ATT&CK framework so people can practice incident response against scenarios that actually resemble the real thing, not a sanitized textbook version.
Alongside that, I've been building out a threat-intel aggregation tool for myself (RSS/Atom feeds, dedup, a terminal UI because I have a weakness for TUIs), and I spend a fair amount of time at Mumbai's cybersecurity meetups and CTFs, mostly listening to people smarter than me talk about things breaking in new ways.
The teaching side
I lecture Programming Languages and Web Technologies to students at a college in Mumbai. I did not expect this to become a real part of my career, and yet, here we are.
What surprised me most is how much it sharpens my own understanding. You can hold a fuzzy mental model of something and still ship working code with it. You cannot stand in front of 40 students and explain that fuzzy model without someone asking the one question that reveals you never actually understood it. Teaching has made me a better engineer more directly than almost any project has.
Things I've built that I'm reasonably proud of
- A SOC simulation backend (Haxnation): JWT auth, MITRE ATT&CK-mapped alert scenarios, JSON-driven so new attack scenarios don't need a database migration.
- A job-outreach automation tool, open-sourced, that does company discovery, contact extraction, and LLM-personalized outreach with a human still in the loop, because fully autonomous cold outreach is how you get your domain blacklisted.
- A QR-code digital menu platform for restaurants: unglamorous, genuinely useful, still running.
- A handful of open source contributions: a merged fix in Pyrebase4, a 440+ line documentation pass on Multer's internals, and a small API migration when a free-tier shutdown nearly killed a public quotes API.
-
mms-forced-align: a Node.js/TypeScript port of CTC forced alignment on top of Meta's MMS acoustic model. Give it audio plus a transcript you already know was spoken, get back the start/end timestamp of every word. As far as I can tell, no published JS implementation of MMS-based forced alignment existed before this; the closest tools were Python-only. It also does something I haven't seen elsewhere in JS: romanizing 20 Indic languages internally so you can align native-script transcripts (Hindi, Tamil, Urdu, Bengali, and so on) and get timings mapped back onto the original script. Verified against
torchaudio's pipeline down to sub-millisecond accuracy, and, mildly satisfying, faster than it in CPU benchmarks too.
Also, this one's actually shipped
Most of what's above is backend work nobody outside the project sees. This one's different: Read Me When is a React Native app, live on Google Play, built as a product of Build Incredibles.
The idea is simple: some feelings are too big for words, so instead of searching, you just pick how you're feeling: happy, anxious, thankful, lonely, angry, sad. The app draws a Quranic verse matched to that feeling. Tap in and you get the Arabic text, transliteration, full translation, recitation audio, and classical tafsir, so you're not just reading words out of context. Save what speaks to you, share it as a designed card, browse by feeling later. No account, no ads. Everything lives locally on the device.
It's the one project on this list where the "does it actually work under real use" question isn't about uptime or load, it's about whether it's actually useful to someone at 2am when they open the app because they don't have the words for what they're feeling. That's a much harder bar than anything else here.
the interesting part was never the recognition, it was the "how do I make this messy, half-formed idea actually work under real load" problem in the middle.
What I'll probably write about here
Mostly: things I build, things that broke while I was building them, and whatever I've been thinking about at the intersection of web dev and security. Sometimes teaching stories, if they generalize past "why did nobody submit the assignment on time."
If you're building something similar, breaking something similar, or teaching something similar, say hi. I'm at arhamsayyed.dev@gmail.com, or @arhamsayyed_dev on X.
