https://omarbadran.dev/blog Notes on AI engineering, application security, DevSecOps and Arabic-first web development, by Omar Badran. en Tue, 28 Jul 2026 09:00:00 GMT contact@omarbadran.dev (Omar Badran) contact@omarbadran.dev (Omar Badran) https://omarbadran.dev/og-image.png https://omarbadran.dev/blog https://omarbadran.dev/blog/ollama-local-models https://omarbadran.dev/blog/ollama-local-models Tue, 28 Jul 2026 09:00:00 GMT AI Engineering One command pulls a model and serves it on localhost. For prototyping, private data, and never paying per token again. https://omarbadran.dev/blog/claude-code-skills https://omarbadran.dev/blog/claude-code-skills Fri, 24 Jul 2026 09:00:00 GMT AI Engineering Prompting the same instructions every session is a waste. A skill is a folder that teaches the model how you work — once — and it pays back on every project after that. https://omarbadran.dev/blog/llama-cpp-quantization https://omarbadran.dev/blog/llama-cpp-quantization Tue, 21 Jul 2026 09:00:00 GMT AI Engineering Q4, Q5, Q8 — the difference between a model that fits your GPU and one that does not, explained without the maths. https://omarbadran.dev/blog/subagent-team https://omarbadran.dev/blog/subagent-team Fri, 17 Jul 2026 09:00:00 GMT AI Engineering One agent writing code is autocomplete. Several specialists who critique and correct each other is a process — and the difference shows up in the diff. https://omarbadran.dev/blog/vllm-serving-throughput https://omarbadran.dev/blog/vllm-serving-throughput Tue, 14 Jul 2026 09:00:00 GMT AI Engineering Continuous batching and paged attention are why a serving stack handles fifty concurrent users on hardware that choked on five. https://omarbadran.dev/blog/claude-md-that-works https://omarbadran.dev/blog/claude-md-that-works Thu, 09 Jul 2026 09:00:00 GMT AI Engineering Most project instruction files are wish lists. The ones that work read like a senior engineer briefing a new hire on day one — specific, ordered, and short. https://omarbadran.dev/blog/open-webui-chat-ui https://omarbadran.dev/blog/open-webui-chat-ui Tue, 07 Jul 2026 09:00:00 GMT AI Engineering Local models are useless to a business until someone non-technical can talk to them. This is the missing half. https://omarbadran.dev/blog/portfolio-that-converts https://omarbadran.dev/blog/portfolio-that-converts Tue, 30 Jun 2026 09:00:00 GMT Design A grid of screenshots tells a client what you touched. A case study tells them what you decided — and decisions are the only thing they are actually buying. https://omarbadran.dev/blog/whisper-speech-to-text https://omarbadran.dev/blog/whisper-speech-to-text Tue, 30 Jun 2026 09:00:00 GMT AI Engineering Most speech-to-text falls apart on Arabic dialects. Here is what actually works, and where it still struggles. https://omarbadran.dev/blog/comfyui-node-pipelines https://omarbadran.dev/blog/comfyui-node-pipelines Tue, 23 Jun 2026 09:00:00 GMT AI Engineering Nodes and graphs look intimidating until you need the same result twice. Then they are the only sane option. https://omarbadran.dev/blog/rtl-first-arabic https://omarbadran.dev/blog/rtl-first-arabic Sun, 21 Jun 2026 09:00:00 GMT Design Flipping a layout to RTL is twenty minutes of CSS. Making an Arabic interface feel native is a different job entirely — and users notice the gap immediately. https://omarbadran.dev/blog/aider-terminal-pair https://omarbadran.dev/blog/aider-terminal-pair Tue, 16 Jun 2026 09:00:00 GMT AI Engineering It edits your repo and writes the commit message. Which is either exactly what you want or a very good reason to work on a branch. https://omarbadran.dev/blog/own-your-name-seo https://omarbadran.dev/blog/own-your-name-seo Fri, 12 Jun 2026 09:00:00 GMT SEO If someone searches your name after a meeting, whatever they find becomes your reference check. Here is the exact stack I used to make sure they find me. https://omarbadran.dev/blog/continue-dev-assistant https://omarbadran.dev/blog/continue-dev-assistant Tue, 09 Jun 2026 09:00:00 GMT AI Engineering Point it at a local model, a cloud model, or both. The value is choosing where your code goes. https://omarbadran.dev/blog/llms-txt-geo https://omarbadran.dev/blog/llms-txt-geo Wed, 03 Jun 2026 09:00:00 GMT SEO People ask a model about you before they open a search engine. Generative engine optimisation is mostly just being unambiguous in machine-readable ways. https://omarbadran.dev/blog/mcp-servers https://omarbadran.dev/blog/mcp-servers Tue, 02 Jun 2026 09:00:00 GMT AI Engineering One protocol so any assistant can talk to your database, your files, your ticketing system. Write the server once. https://omarbadran.dev/blog/whatsapp-checkout https://omarbadran.dev/blog/whatsapp-checkout Tue, 26 May 2026 09:00:00 GMT Product I built a storefront with no payment gateway on purpose. In the right market, a well-formed WhatsApp message converts better than any card form you can design. https://omarbadran.dev/blog/langchain-when-to-use https://omarbadran.dev/blog/langchain-when-to-use Tue, 26 May 2026 09:00:00 GMT AI Engineering For a three-step chain, the raw SDK is shorter and clearer. For an agent with twelve tools and retries, it is not. https://omarbadran.dev/blog/llamaindex-rag https://omarbadran.dev/blog/llamaindex-rag Tue, 19 May 2026 09:00:00 GMT AI Engineering Chunking strategy decides whether your retrieval works. Everything else is a distant second. https://omarbadran.dev/blog/security-by-design-small-teams https://omarbadran.dev/blog/security-by-design-small-teams Mon, 18 May 2026 09:00:00 GMT Security You do not get a security review, a pentest budget, or a second pair of eyes. What you get is the ability to make the cheap decisions early — before they become expensive. https://omarbadran.dev/blog/qdrant-vector-search https://omarbadran.dev/blog/qdrant-vector-search Tue, 12 May 2026 09:00:00 GMT AI Engineering Filtered search is the feature that decides this, not raw benchmark numbers nobody reproduces. https://omarbadran.dev/blog/llm-proxy-pii https://omarbadran.dev/blog/llm-proxy-pii Fri, 08 May 2026 09:00:00 GMT Security Every AI feature I ship sits behind a server proxy that redacts personal data before it leaves the building. Here is the shape of that proxy, and why each part exists. https://omarbadran.dev/blog/n8n-ai-automation https://omarbadran.dev/blog/n8n-ai-automation Tue, 05 May 2026 09:00:00 GMT AI Engineering A workflow the client can see and edit beats a cron job only you understand. https://omarbadran.dev/blog/email-otp-2fa https://omarbadran.dev/blog/email-otp-2fa Tue, 28 Apr 2026 09:00:00 GMT Security One-time codes are easy to add and easy to get wrong. Six digits with no rate limit, no expiry, and a leaky error message is worse than no second factor at all. https://omarbadran.dev/blog/dify-llmops https://omarbadran.dev/blog/dify-llmops Tue, 28 Apr 2026 09:00:00 GMT AI Engineering Prompt versioning, logs, and spend limits — the boring parts that make an AI feature survive contact with a real team. https://omarbadran.dev/blog/ragas-eval https://omarbadran.dev/blog/ragas-eval Tue, 21 Apr 2026 09:00:00 GMT AI Engineering Faithfulness, relevance, context precision. Three numbers that turn "it feels better" into a decision. https://omarbadran.dev/blog/image-heavy-cwv https://omarbadran.dev/blog/image-heavy-cwv Thu, 16 Apr 2026 09:00:00 GMT Performance Photography studios, interior designers, florists — my clients sell with pictures. Making those sites fast is a constraint problem, not a plugin you install. https://omarbadran.dev/blog/unsloth-finetuning https://omarbadran.dev/blog/unsloth-finetuning Tue, 14 Apr 2026 09:00:00 GMT AI Engineering Before you fine-tune anything, read the part about why your problem is probably a retrieval problem. https://omarbadran.dev/blog/openai-agents-patterns https://omarbadran.dev/blog/openai-agents-patterns Tue, 07 Apr 2026 09:00:00 GMT AI Engineering Loop limits, tool timeouts, and a hard budget. An agent without these is an outage with a personality. https://omarbadran.dev/blog/self-host-fonts https://omarbadran.dev/blog/self-host-fonts Sun, 05 Apr 2026 09:00:00 GMT Performance Two link tags to a font CDN cost you a DNS lookup, a connection, a redirect chain, and a layout shift — on the most visible text on the page. https://omarbadran.dev/blog/owasp-llm-top-10 https://omarbadran.dev/blog/owasp-llm-top-10 Tue, 31 Mar 2026 09:00:00 GMT AI Security Prompt injection, insecure output handling, excessive agency. Each one with the line of code that prevents it. https://omarbadran.dev/blog/client-monorepo https://omarbadran.dev/blog/client-monorepo Tue, 24 Mar 2026 09:00:00 GMT Engineering Public site, admin dashboard, API. Three apps that must agree on types and ship together. Splitting them across three repos is how small teams create integration bugs. https://omarbadran.dev/blog/prompt-injection-defense https://omarbadran.dev/blog/prompt-injection-defense Tue, 24 Mar 2026 09:00:00 GMT AI Security You cannot instruct your way out of it. The fix is architectural: assume the model will be turned against you. https://omarbadran.dev/blog/garak-llm-scanner https://omarbadran.dev/blog/garak-llm-scanner Tue, 17 Mar 2026 09:00:00 GMT AI Security A vulnerability scanner aimed at model behaviour — jailbreaks, leakage, toxicity — run in CI like any other test. https://omarbadran.dev/blog/case-studies-not-screenshots https://omarbadran.dev/blog/case-studies-not-screenshots Wed, 11 Mar 2026 09:00:00 GMT Career The five-part structure I use for every project write-up, and the one question that decides whether a paragraph stays in or gets cut. https://omarbadran.dev/blog/pyrit-red-teaming https://omarbadran.dev/blog/pyrit-red-teaming Tue, 10 Mar 2026 09:00:00 GMT AI Security An hour of structured attack attempts before launch is worth more than any amount of post-incident analysis. https://omarbadran.dev/blog/presidio-pii-redaction https://omarbadran.dev/blog/presidio-pii-redaction Tue, 03 Mar 2026 09:00:00 GMT AI Security My hand-rolled patterns caught emails and phones. They missed everything shaped slightly differently. https://omarbadran.dev/blog/llm-guard-output https://omarbadran.dev/blog/llm-guard-output Tue, 24 Feb 2026 09:00:00 GMT AI Security Rendering generated text as HTML is XSS where the payload is written by a stranger through your own feature. https://omarbadran.dev/blog/model-supply-chain https://omarbadran.dev/blog/model-supply-chain Tue, 17 Feb 2026 09:00:00 GMT AI Security Pickle-based checkpoints can run arbitrary code on load. Downloading weights from a random mirror is not neutral. https://omarbadran.dev/blog/agentic-ai-risk https://omarbadran.dev/blog/agentic-ai-risk Tue, 10 Feb 2026 09:00:00 GMT AI Security Give an agent shell access and a budget, and you have built an insider threat that never sleeps. https://omarbadran.dev/blog/nuclei-templates https://omarbadran.dev/blog/nuclei-templates Tue, 03 Feb 2026 09:00:00 GMT Security Templates are YAML. You can audit exactly what a check does before you run it against a client. https://omarbadran.dev/blog/semgrep-custom-rules https://omarbadran.dev/blog/semgrep-custom-rules Tue, 27 Jan 2026 09:00:00 GMT Security The generic ruleset finds generic bugs. The rule you write for your own mistake finds it forever. https://omarbadran.dev/blog/trivy-container-scanning https://omarbadran.dev/blog/trivy-container-scanning Tue, 20 Jan 2026 09:00:00 GMT Security Add it to CI in ten minutes. Then spend a week deciding which findings you are actually going to fix. https://omarbadran.dev/blog/osv-scanner-deps https://omarbadran.dev/blog/osv-scanner-deps Tue, 13 Jan 2026 09:00:00 GMT Security A twelve-line utility can pull in ninety packages. Every one of them runs with your privileges. https://omarbadran.dev/blog/gitleaks-secret-scanning https://omarbadran.dev/blog/gitleaks-secret-scanning Tue, 06 Jan 2026 09:00:00 GMT Security Deleting the line does nothing. Rotating the credential is the only fix, and a pre-commit hook is the only prevention. https://omarbadran.dev/blog/trufflehog-verified-secrets https://omarbadran.dev/blog/trufflehog-verified-secrets Tue, 30 Dec 2025 09:00:00 GMT Security A scanner that tests whether a found key is live turns a thousand false positives into three real emergencies. https://omarbadran.dev/blog/zap-dast-ci https://omarbadran.dev/blog/zap-dast-ci Tue, 23 Dec 2025 09:00:00 GMT Security A baseline scan on every pull request, a full scan nightly. Getting that split wrong is why teams turn DAST off. https://omarbadran.dev/blog/wazuh-siem-small https://omarbadran.dev/blog/wazuh-siem-small Tue, 16 Dec 2025 09:00:00 GMT Security Log collection you never read is theatre. Three alerts you actually respond to is a security programme. https://omarbadran.dev/blog/sigma-detection-rules https://omarbadran.dev/blog/sigma-detection-rules Tue, 09 Dec 2025 09:00:00 GMT Security Write the detection once in a vendor-neutral format, convert it to whatever your SIEM speaks. https://omarbadran.dev/blog/atomic-red-team https://omarbadran.dev/blog/atomic-red-team Tue, 02 Dec 2025 09:00:00 GMT Security Everyone deploys detection. Almost nobody verifies it triggers. Small, safe, mapped test cases fix that. https://omarbadran.dev/blog/falco-runtime-security https://omarbadran.dev/blog/falco-runtime-security Tue, 25 Nov 2025 09:00:00 GMT Security A clean image can still spawn a shell at 3am. Build-time scanning cannot see that; runtime rules can. https://omarbadran.dev/blog/projectdiscovery-recon https://omarbadran.dev/blog/projectdiscovery-recon Tue, 18 Nov 2025 09:00:00 GMT Security Subfinder into httpx into nuclei. Three tools, one pipe, and the whole external surface of an authorised target. https://omarbadran.dev/blog/sigstore-signing https://omarbadran.dev/blog/sigstore-signing Tue, 11 Nov 2025 09:00:00 GMT DevSecOps Keyless signing tied to your CI identity. The barrier to supply-chain integrity dropped to almost nothing. https://omarbadran.dev/blog/sbom-syft-grype https://omarbadran.dev/blog/sbom-syft-grype Tue, 04 Nov 2025 09:00:00 GMT DevSecOps When the next Log4j lands, the only question that matters is "are we affected". An SBOM answers it in seconds. https://omarbadran.dev/blog/renovate-dependency-updates https://omarbadran.dev/blog/renovate-dependency-updates Tue, 28 Oct 2025 09:00:00 GMT DevSecOps Grouping, scheduling and auto-merge for patches. Otherwise you get forty pull requests and ignore all of them. https://omarbadran.dev/blog/github-actions-hardening https://omarbadran.dev/blog/github-actions-hardening Tue, 21 Oct 2025 09:00:00 GMT DevSecOps Pin actions to a commit SHA, scope permissions per job, never run untrusted code on a privileged trigger. https://omarbadran.dev/blog/infisical-secrets https://omarbadran.dev/blog/infisical-secrets Tue, 14 Oct 2025 09:00:00 GMT DevSecOps Not in the repo, not in a WhatsApp message, not in a .env you emailed. Here is the small-team answer. https://omarbadran.dev/blog/pre-commit-hooks https://omarbadran.dev/blog/pre-commit-hooks Tue, 07 Oct 2025 09:00:00 GMT DevSecOps Secret scan, formatter, linter, large-file guard. Four hooks that prevent the four most common self-inflicted wounds. https://omarbadran.dev/blog/docker-image-slimming https://omarbadran.dev/blog/docker-image-slimming Tue, 30 Sep 2025 09:00:00 GMT DevSecOps No shell, no package manager, no curl. Most of your CVE count comes from tools your app never uses. https://omarbadran.dev/blog/biome-toolchain https://omarbadran.dev/blog/biome-toolchain Tue, 23 Sep 2025 09:00:00 GMT Tooling Linting and formatting in a single binary. On a mid-size project the difference is seconds versus instant. https://omarbadran.dev/blog/bun-runtime https://omarbadran.dev/blog/bun-runtime Tue, 16 Sep 2025 09:00:00 GMT Tooling Install speed and the test runner are genuinely great. Production deployment is where I stay conservative. https://omarbadran.dev/blog/astro-islands https://omarbadran.dev/blog/astro-islands Tue, 09 Sep 2025 09:00:00 GMT Tooling A marketing site does not need a hydrated framework on every page. Islands make that an architecture, not a compromise. https://omarbadran.dev/blog/shadcn-copy-paste-ui https://omarbadran.dev/blog/shadcn-copy-paste-ui Tue, 02 Sep 2025 09:00:00 GMT Tooling You own the file, so you can restyle it into a brutalist theme without fighting a library you cannot edit. https://omarbadran.dev/blog/playwright-e2e https://omarbadran.dev/blog/playwright-e2e Tue, 26 Aug 2025 09:00:00 GMT Tooling Unit tests protect you. End-to-end tests protect the checkout. Guess which one the client cares about. https://omarbadran.dev/blog/zod-runtime-validation https://omarbadran.dev/blog/zod-runtime-validation Tue, 19 Aug 2025 09:00:00 GMT Tooling Your compile-time safety does nothing to a malformed request body. One schema per route closes the gap.