https://omarbadran.dev/ 2026-07-29 monthly 1.0 https://omarbadran.dev/profile-sticker.webp Omar Badran — عمر بدران — Full Stack Developer and AppSec Specialist, Alexandria Egypt Omar Badran (عمر بدران), Full Stack Developer and Application Security Specialist based in Alexandria, Egypt. Available for hire. https://omarbadran.dev/cv 2026-07-29 monthly 0.9 https://omarbadran.dev/blog 2026-07-28 weekly 0.8 https://omarbadran.dev/blog/ollama-local-models 2026-07-28 yearly 0.6 https://omarbadran.dev/img/blog/ollama-local-models.webp Ollama: Run Real Models on Your Own Machine One command pulls a model and serves it on localhost. For prototyping, private data, and never paying per token again. https://omarbadran.dev/blog/claude-code-skills 2026-07-24 yearly 0.6 https://omarbadran.dev/img/blog/claude-code-skills.webp Turn Your Workflow Into a Claude Skill Prompting the same instructions every session is a waste. A skill is a folder that teaches the model how you work — once — and it pays back on every project after that. https://omarbadran.dev/blog/llama-cpp-quantization 2026-07-21 yearly 0.6 https://omarbadran.dev/img/blog/llama-cpp-quantization.webp llama.cpp and the Quantization You Actually Need Q4, Q5, Q8 — the difference between a model that fits your GPU and one that does not, explained without the maths. https://omarbadran.dev/blog/subagent-team 2026-07-17 yearly 0.6 https://omarbadran.dev/img/blog/subagent-team.webp Building a Subagent Team That Reviews Its Own Work One agent writing code is autocomplete. Several specialists who critique and correct each other is a process — and the difference shows up in the diff. https://omarbadran.dev/blog/vllm-serving-throughput 2026-07-14 yearly 0.6 https://omarbadran.dev/img/blog/vllm-serving-throughput.webp vLLM: When You Outgrow One Request at a Time Continuous batching and paged attention are why a serving stack handles fifty concurrent users on hardware that choked on five. https://omarbadran.dev/blog/claude-md-that-works 2026-07-09 yearly 0.6 https://omarbadran.dev/img/blog/claude-md-that-works.webp Writing a CLAUDE.md the Model Actually Follows Most project instruction files are wish lists. The ones that work read like a senior engineer briefing a new hire on day one — specific, ordered, and short. https://omarbadran.dev/blog/open-webui-chat-ui 2026-07-07 yearly 0.6 https://omarbadran.dev/img/blog/open-webui-chat-ui.webp Open WebUI: A Chat Front-End Your Client Can Actually Use Local models are useless to a business until someone non-technical can talk to them. This is the missing half. https://omarbadran.dev/blog/portfolio-that-converts 2026-06-30 yearly 0.6 https://omarbadran.dev/img/blog/portfolio-that-converts.webp Your Portfolio Is a Product, Not a Gallery A grid of screenshots tells a client what you touched. A case study tells them what you decided — and decisions are the only thing they are actually buying. https://omarbadran.dev/blog/whisper-speech-to-text 2026-06-30 yearly 0.6 https://omarbadran.dev/img/blog/whisper-speech-to-text.webp Whisper: Transcription That Handles Arabic Most speech-to-text falls apart on Arabic dialects. Here is what actually works, and where it still struggles. https://omarbadran.dev/blog/comfyui-node-pipelines 2026-06-23 yearly 0.6 https://omarbadran.dev/img/blog/comfyui-node-pipelines.webp ComfyUI: Image Generation as a Pipeline, Not a Prompt Box Nodes and graphs look intimidating until you need the same result twice. Then they are the only sane option. https://omarbadran.dev/blog/rtl-first-arabic 2026-06-21 yearly 0.6 https://omarbadran.dev/img/blog/rtl-first-arabic.webp Arabic-First, Not Arabic-Translated Flipping a layout to RTL is twenty minutes of CSS. Making an Arabic interface feel native is a different job entirely — and users notice the gap immediately. https://omarbadran.dev/blog/aider-terminal-pair 2026-06-16 yearly 0.6 https://omarbadran.dev/img/blog/aider-terminal-pair.webp Aider: AI Pair Programming That Commits It edits your repo and writes the commit message. Which is either exactly what you want or a very good reason to work on a branch. https://omarbadran.dev/blog/own-your-name-seo 2026-06-12 yearly 0.6 https://omarbadran.dev/img/blog/own-your-name-seo.webp Owning Your Own Name in Search If someone searches your name after a meeting, whatever they find becomes your reference check. Here is the exact stack I used to make sure they find me. https://omarbadran.dev/blog/continue-dev-assistant 2026-06-09 yearly 0.6 https://omarbadran.dev/img/blog/continue-dev-assistant.webp Continue: An Open-Source Coding Assistant You Control Point it at a local model, a cloud model, or both. The value is choosing where your code goes. https://omarbadran.dev/blog/llms-txt-geo 2026-06-03 yearly 0.6 https://omarbadran.dev/img/blog/llms-txt-geo.webp Getting Cited by AI Answer Engines People ask a model about you before they open a search engine. Generative engine optimisation is mostly just being unambiguous in machine-readable ways. https://omarbadran.dev/blog/mcp-servers 2026-06-02 yearly 0.6 https://omarbadran.dev/img/blog/mcp-servers.webp Model Context Protocol: Stop Writing Bespoke Tool Glue One protocol so any assistant can talk to your database, your files, your ticketing system. Write the server once. https://omarbadran.dev/blog/whatsapp-checkout 2026-05-26 yearly 0.6 https://omarbadran.dev/img/blog/whatsapp-checkout.webp When the Best Checkout Is No Checkout I built a storefront with no payment gateway on purpose. In the right market, a well-formed WhatsApp message converts better than any card form you can design. https://omarbadran.dev/blog/langchain-when-to-use 2026-05-26 yearly 0.6 https://omarbadran.dev/img/blog/langchain-when-to-use.webp LangChain: When the Framework Helps and When It Hurts For a three-step chain, the raw SDK is shorter and clearer. For an agent with twelve tools and retries, it is not. https://omarbadran.dev/blog/llamaindex-rag 2026-05-19 yearly 0.6 https://omarbadran.dev/img/blog/llamaindex-rag.webp LlamaIndex: RAG Beyond the Toy Example Chunking strategy decides whether your retrieval works. Everything else is a distant second. https://omarbadran.dev/blog/security-by-design-small-teams 2026-05-18 yearly 0.6 https://omarbadran.dev/img/blog/security-by-design-small-teams.webp Security by Design When You Are the Whole Team You do not get a security review, a pentest budget, or a second pair of eyes. What you get is the ability to make the cheap decisions early — before they become expensive. https://omarbadran.dev/blog/qdrant-vector-search 2026-05-12 yearly 0.6 https://omarbadran.dev/img/blog/qdrant-vector-search.webp Qdrant: Picking a Vector Database Without the Hype Filtered search is the feature that decides this, not raw benchmark numbers nobody reproduces. https://omarbadran.dev/blog/llm-proxy-pii 2026-05-08 yearly 0.6 https://omarbadran.dev/img/blog/llm-proxy-pii.webp Never Put Your API Key in the Browser Every AI feature I ship sits behind a server proxy that redacts personal data before it leaves the building. Here is the shape of that proxy, and why each part exists. https://omarbadran.dev/blog/n8n-ai-automation 2026-05-05 yearly 0.6 https://omarbadran.dev/img/blog/n8n-ai-automation.webp n8n: Automation That Survives the Client Handover A workflow the client can see and edit beats a cron job only you understand. https://omarbadran.dev/blog/email-otp-2fa 2026-04-28 yearly 0.6 https://omarbadran.dev/img/blog/email-otp-2fa.webp Email OTP That Is Not Security Theatre One-time codes are easy to add and easy to get wrong. Six digits with no rate limit, no expiry, and a leaky error message is worse than no second factor at all. https://omarbadran.dev/blog/dify-llmops 2026-04-28 yearly 0.6 https://omarbadran.dev/img/blog/dify-llmops.webp Dify: Giving Non-Developers a Safe AI Playground Prompt versioning, logs, and spend limits — the boring parts that make an AI feature survive contact with a real team. https://omarbadran.dev/blog/ragas-eval 2026-04-21 yearly 0.6 https://omarbadran.dev/img/blog/ragas-eval.webp Ragas: You Cannot Improve a RAG You Do Not Measure Faithfulness, relevance, context precision. Three numbers that turn "it feels better" into a decision. https://omarbadran.dev/blog/image-heavy-cwv 2026-04-16 yearly 0.6 https://omarbadran.dev/img/blog/image-heavy-cwv.webp Core Web Vitals on an Image-Heavy Site Photography studios, interior designers, florists — my clients sell with pictures. Making those sites fast is a constraint problem, not a plugin you install. https://omarbadran.dev/blog/unsloth-finetuning 2026-04-14 yearly 0.6 https://omarbadran.dev/img/blog/unsloth-finetuning.webp Unsloth: Fine-Tuning on Hardware You Already Have Before you fine-tune anything, read the part about why your problem is probably a retrieval problem. https://omarbadran.dev/blog/openai-agents-patterns 2026-04-07 yearly 0.6 https://omarbadran.dev/img/blog/openai-agents-patterns.webp Agent Patterns That Survive Production Loop limits, tool timeouts, and a hard budget. An agent without these is an outage with a personality. https://omarbadran.dev/blog/self-host-fonts 2026-04-05 yearly 0.6 https://omarbadran.dev/img/blog/self-host-fonts.webp Self-Host Your Fonts. All of Them. Two link tags to a font CDN cost you a DNS lookup, a connection, a redirect chain, and a layout shift — on the most visible text on the page. https://omarbadran.dev/blog/owasp-llm-top-10 2026-03-31 yearly 0.6 https://omarbadran.dev/img/blog/owasp-llm-top-10.webp The OWASP LLM Top 10, Translated Into Actual Fixes Prompt injection, insecure output handling, excessive agency. Each one with the line of code that prevents it. https://omarbadran.dev/blog/client-monorepo 2026-03-24 yearly 0.6 https://omarbadran.dev/img/blog/client-monorepo.webp One Monorepo Per Client Public site, admin dashboard, API. Three apps that must agree on types and ship together. Splitting them across three repos is how small teams create integration bugs. https://omarbadran.dev/blog/prompt-injection-defense 2026-03-24 yearly 0.6 https://omarbadran.dev/img/blog/prompt-injection-defense.webp Prompt Injection Is Not a Prompt Problem You cannot instruct your way out of it. The fix is architectural: assume the model will be turned against you. https://omarbadran.dev/blog/garak-llm-scanner 2026-03-17 yearly 0.6 https://omarbadran.dev/img/blog/garak-llm-scanner.webp Garak: Scan Your LLM App Before Someone Else Does A vulnerability scanner aimed at model behaviour — jailbreaks, leakage, toxicity — run in CI like any other test. https://omarbadran.dev/blog/case-studies-not-screenshots 2026-03-11 yearly 0.6 https://omarbadran.dev/img/blog/case-studies-not-screenshots.webp Write Case Studies, Not Screenshots The five-part structure I use for every project write-up, and the one question that decides whether a paragraph stays in or gets cut. https://omarbadran.dev/blog/pyrit-red-teaming 2026-03-10 yearly 0.6 https://omarbadran.dev/img/blog/pyrit-red-teaming.webp Red-Teaming Your Own AI Feature An hour of structured attack attempts before launch is worth more than any amount of post-incident analysis. https://omarbadran.dev/blog/presidio-pii-redaction 2026-03-03 yearly 0.6 https://omarbadran.dev/img/blog/presidio-pii-redaction.webp Presidio: Redaction That Beats Your Regex My hand-rolled patterns caught emails and phones. They missed everything shaped slightly differently. https://omarbadran.dev/blog/llm-guard-output 2026-02-24 yearly 0.6 https://omarbadran.dev/img/blog/llm-guard-output.webp Treat Model Output Like User Input Rendering generated text as HTML is XSS where the payload is written by a stranger through your own feature. https://omarbadran.dev/blog/model-supply-chain 2026-02-17 yearly 0.6 https://omarbadran.dev/img/blog/model-supply-chain.webp That Model File Is Executable Code Pickle-based checkpoints can run arbitrary code on load. Downloading weights from a random mirror is not neutral. https://omarbadran.dev/blog/agentic-ai-risk 2026-02-10 yearly 0.6 https://omarbadran.dev/img/blog/agentic-ai-risk.webp The Blast Radius of an Autonomous Agent Give an agent shell access and a budget, and you have built an insider threat that never sleeps. https://omarbadran.dev/blog/nuclei-templates 2026-02-03 yearly 0.6 https://omarbadran.dev/img/blog/nuclei-templates.webp Nuclei: Vulnerability Scanning You Can Read Templates are YAML. You can audit exactly what a check does before you run it against a client. https://omarbadran.dev/blog/semgrep-custom-rules 2026-01-27 yearly 0.6 https://omarbadran.dev/img/blog/semgrep-custom-rules.webp Writing a Semgrep Rule for Your Own Codebase The generic ruleset finds generic bugs. The rule you write for your own mistake finds it forever. https://omarbadran.dev/blog/trivy-container-scanning 2026-01-20 yearly 0.6 https://omarbadran.dev/img/blog/trivy-container-scanning.webp Trivy: One Scanner for Images, IaC and Dependencies Add it to CI in ten minutes. Then spend a week deciding which findings you are actually going to fix. https://omarbadran.dev/blog/osv-scanner-deps 2026-01-13 yearly 0.6 https://omarbadran.dev/img/blog/osv-scanner-deps.webp Your Dependency Tree Is Your Attack Surface A twelve-line utility can pull in ninety packages. Every one of them runs with your privileges. https://omarbadran.dev/blog/gitleaks-secret-scanning 2026-01-06 yearly 0.6 https://omarbadran.dev/img/blog/gitleaks-secret-scanning.webp The Secret You Committed Is Still in the History Deleting the line does nothing. Rotating the credential is the only fix, and a pre-commit hook is the only prevention. https://omarbadran.dev/blog/trufflehog-verified-secrets 2025-12-30 yearly 0.6 https://omarbadran.dev/img/blog/trufflehog-verified-secrets.webp Secret Scanning That Verifies Before It Alarms A scanner that tests whether a found key is live turns a thousand false positives into three real emergencies. https://omarbadran.dev/blog/zap-dast-ci 2025-12-23 yearly 0.6 https://omarbadran.dev/img/blog/zap-dast-ci.webp OWASP ZAP in CI Without Wrecking Your Pipeline A baseline scan on every pull request, a full scan nightly. Getting that split wrong is why teams turn DAST off. https://omarbadran.dev/blog/wazuh-siem-small 2025-12-16 yearly 0.6 https://omarbadran.dev/img/blog/wazuh-siem-small.webp A SIEM for Teams Who Cannot Afford a SOC Log collection you never read is theatre. Three alerts you actually respond to is a security programme. https://omarbadran.dev/blog/sigma-detection-rules 2025-12-09 yearly 0.6 https://omarbadran.dev/img/blog/sigma-detection-rules.webp Detection as Code with Sigma Rules Write the detection once in a vendor-neutral format, convert it to whatever your SIEM speaks. https://omarbadran.dev/blog/atomic-red-team 2025-12-02 yearly 0.6 https://omarbadran.dev/img/blog/atomic-red-team.webp Testing Whether Your Alerts Actually Fire Everyone deploys detection. Almost nobody verifies it triggers. Small, safe, mapped test cases fix that. https://omarbadran.dev/blog/falco-runtime-security 2025-11-25 yearly 0.6 https://omarbadran.dev/img/blog/falco-runtime-security.webp Runtime Security: Catching What the Scanner Missed A clean image can still spawn a shell at 3am. Build-time scanning cannot see that; runtime rules can. https://omarbadran.dev/blog/projectdiscovery-recon 2025-11-18 yearly 0.6 https://omarbadran.dev/img/blog/projectdiscovery-recon.webp Building a Recon Workflow With ProjectDiscovery Tools Subfinder into httpx into nuclei. Three tools, one pipe, and the whole external surface of an authorised target. https://omarbadran.dev/blog/sigstore-signing 2025-11-11 yearly 0.6 https://omarbadran.dev/img/blog/sigstore-signing.webp Signing Your Artifacts Without Managing Keys Keyless signing tied to your CI identity. The barrier to supply-chain integrity dropped to almost nothing. https://omarbadran.dev/blog/sbom-syft-grype 2025-11-04 yearly 0.6 https://omarbadran.dev/img/blog/sbom-syft-grype.webp An SBOM Is Just an Honest Inventory When the next Log4j lands, the only question that matters is "are we affected". An SBOM answers it in seconds. https://omarbadran.dev/blog/renovate-dependency-updates 2025-10-28 yearly 0.6 https://omarbadran.dev/img/blog/renovate-dependency-updates.webp Automating Dependency Updates Without Drowning Grouping, scheduling and auto-merge for patches. Otherwise you get forty pull requests and ignore all of them. https://omarbadran.dev/blog/github-actions-hardening 2025-10-21 yearly 0.6 https://omarbadran.dev/img/blog/github-actions-hardening.webp Your CI Has More Secrets Than Your Production Server Pin actions to a commit SHA, scope permissions per job, never run untrusted code on a privileged trigger. https://omarbadran.dev/blog/infisical-secrets 2025-10-14 yearly 0.6 https://omarbadran.dev/img/blog/infisical-secrets.webp Where Client Project Secrets Should Actually Live Not in the repo, not in a WhatsApp message, not in a .env you emailed. Here is the small-team answer. https://omarbadran.dev/blog/pre-commit-hooks 2025-10-07 yearly 0.6 https://omarbadran.dev/img/blog/pre-commit-hooks.webp The Pre-Commit Hooks Worth Installing Today Secret scan, formatter, linter, large-file guard. Four hooks that prevent the four most common self-inflicted wounds. https://omarbadran.dev/blog/docker-image-slimming 2025-09-30 yearly 0.6 https://omarbadran.dev/img/blog/docker-image-slimming.webp A Smaller Image Is a Smaller Attack Surface No shell, no package manager, no curl. Most of your CVE count comes from tools your app never uses. https://omarbadran.dev/blog/biome-toolchain 2025-09-23 yearly 0.6 https://omarbadran.dev/img/blog/biome-toolchain.webp Biome: Replacing Two Tools With One Fast One Linting and formatting in a single binary. On a mid-size project the difference is seconds versus instant. https://omarbadran.dev/blog/bun-runtime 2025-09-16 yearly 0.6 https://omarbadran.dev/img/blog/bun-runtime.webp Bun: Where It Wins and Where I Still Use Node Install speed and the test runner are genuinely great. Production deployment is where I stay conservative. https://omarbadran.dev/blog/astro-islands 2025-09-09 yearly 0.6 https://omarbadran.dev/img/blog/astro-islands.webp Astro: Ship Less JavaScript on Content Sites A marketing site does not need a hydrated framework on every page. Islands make that an architecture, not a compromise. https://omarbadran.dev/blog/shadcn-copy-paste-ui 2025-09-02 yearly 0.6 https://omarbadran.dev/img/blog/shadcn-copy-paste-ui.webp The Copy-Paste Component Model You own the file, so you can restyle it into a brutalist theme without fighting a library you cannot edit. https://omarbadran.dev/blog/playwright-e2e 2025-08-26 yearly 0.6 https://omarbadran.dev/img/blog/playwright-e2e.webp Playwright: The Only Tests Clients Ever Notice Unit tests protect you. End-to-end tests protect the checkout. Guess which one the client cares about. https://omarbadran.dev/blog/zod-runtime-validation 2025-08-19 yearly 0.6 https://omarbadran.dev/img/blog/zod-runtime-validation.webp TypeScript Types Vanish at Runtime Your compile-time safety does nothing to a malformed request body. One schema per route closes the gap.