https://omarbadran.dev/ 2026-08-25 monthly 1.0 https://omarbadran.dev/profile-sticker.webp Omar Badran — عمر بدران Full-Stack developer and application security specialist in Alexandria, Egypt. https://omarbadran.dev/cv 2026-08-25 monthly 0.9 https://omarbadran.dev/projects 2026-08-25 monthly 0.9 https://omarbadran.dev/blog 2026-08-15 weekly 0.8 https://omarbadran.dev/projects/remas-residence 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/remas-residence/1.webp Remas Residences A bilingual, Arabic-first marketing and lead site for Remas Residences — an Egyptian real-estate developer established in 2011 and based in New Borg El Arab, Alexandria. React 18 + TypeScript on Vite 6 and Tailwind 4, with a custom build-time prerenderer that writes real per-locale metadata for every route. The content model refuses to publish an unverified price, delivery date or unit count: commercial fields are optional, every project record starts non-indexable, and promotion is an explicit decision. https://omarbadran.dev/projects/tulip 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/tulip/1.webp Tulip Flowers A multi-location luxury flower storefront for the Egyptian market — Alexandria, New Borg Al Arab, and Alamein — each branch running as an independent store with its own pricing, availability, and imagery. Arabic RTL-first, with no payment gateway by design: checkout composes a fully-Arabic WhatsApp order message the shop owner confirms offline. React 18 + Vite + TypeScript monorepo with an Express + Prisma backend and a full admin dashboard. https://omarbadran.dev/projects/avenue 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/avenue/1.webp Avenue Interior Design A premium interior-design and decoration platform for a Borg El Arab company serving all of Egypt — two businesses on one site: full design/decoration services plus a deep, browsable catalog of materials and furniture organized by type, color, value tier, and style. Three-app deploy: public React SPA, staff admin dashboard, and an Express + Prisma API with email-OTP 2FA, a bookings state machine, and a Gemini AI assistant proxy with PII redaction. https://omarbadran.dev/projects/sky-lens 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/sky-lens/1.webp SkyLens A premium photography studio website, rebuilt and expanded — immersive gallery experience, booking system, cinematic scroll animations, and now a production backend powering content management behind the scenes. Focused on performance and visual storytelling — proof that the web can feel like cinema. https://omarbadran.dev/projects/cyber-masry 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/cyber-masry/1.webp Cyber Masry An Egyptian cybersecurity platform providing threat intelligence, security training, and enterprise-grade tools. Built with security-first architecture and real-time monitoring dashboards. Every endpoint hardened, every data flow encrypted — a platform born from real-world AppSec experience. https://omarbadran.dev/projects/sanad 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/sanad/1.webp Sanad A cybersecurity and digital solutions platform for a Saudi-based information security firm. Built with a security-first architecture to support threat protection services, IT governance, and digital transformation — serving enterprise clients across the Kingdom with a clean, professional Arabic-first interface. https://omarbadran.dev/projects/ahm-construction 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/AHM/1.webp AHM Construction A premium web presence for AHM للتشييد والبناء — a Kuwaiti luxury construction and engineering company. Bold visual design, a structured project showcase, and a seamless client experience that matches the caliber of their on-site engineering. https://omarbadran.dev/projects/almentor 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/almentor/1.webp Almentor A comprehensive e-learning platform connecting students with expert mentors. Features live sessions, course management, and progress tracking — built for scale with a clean modern interface. Designed to make world-class education accessible across the Arab world. https://omarbadran.dev/projects/unit-enterprise 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/unit-enterprise/1.webp Unit Enterprise A corporate enterprise platform for business management and team collaboration. Features a real-time dashboard, CRM integration, and analytics built for data-driven decisions at scale. Architecture designed for reliability under enterprise workloads. https://omarbadran.dev/projects/old-portfolios 2026-08-25 monthly 0.8 https://omarbadran.dev/projects/old-portfolio/1.webp Old Portfolios Two earlier generations of this portfolio — each a snapshot of my design and development evolution. Built from scratch, each version reflects a different chapter of my journey as a full-stack developer. V3 is the loudest one yet. https://omarbadran.dev/blog/crowdsec-behavioral-blocking 2026-08-15 yearly 0.6 https://omarbadran.dev/img/blog-v2/crowdsec-behavioral-blocking.webp Blocking Bad Traffic by Behaviour, Not by IP List Read your own logs, detect the patterns that matter, and act. Plus the shared-signal model, and why you should not trust it blindly. https://omarbadran.dev/blog/opa-policy-as-code 2026-08-15 yearly 0.6 https://omarbadran.dev/img/blog-v2/opa-policy-as-code.webp Authorisation Rules Belong in One Place When 'who can do what' is scattered across handlers, no one can answer the question. Policy as code makes the rules readable, testable and reviewable. https://omarbadran.dev/blog/owasp-cheatsheets 2026-08-14 yearly 0.6 https://omarbadran.dev/img/blog-v2/owasp-cheatsheets.webp The OWASP Cheat Sheets Are the Answer to Most Security Questions Not the Top 10 — the cheat sheets. Concrete, implementation-level guidance on the things you are actually about to get wrong. https://omarbadran.dev/blog/dompurify-xss-sanitizer 2026-08-14 yearly 0.6 https://omarbadran.dev/img/blog-v2/dompurify-xss-sanitizer.webp Sanitising HTML: Do Not Write Your Own If your app renders HTML it did not write, you need a sanitiser. Regex is not a sanitiser, and the bypasses that prove it are more creative than you expect. https://omarbadran.dev/blog/markitdown-rag-ingest 2026-08-13 yearly 0.6 https://omarbadran.dev/img/blog-v2/markitdown-rag-ingest.webp Your RAG Pipeline Is Only as Good as the Text You Fed It Most retrieval failures happen at ingestion. Converting documents to clean structured markdown before chunking fixes more than any embedding model change. https://omarbadran.dev/blog/openhands-autonomous-dev 2026-08-13 yearly 0.6 https://omarbadran.dev/img/blog-v2/openhands-autonomous-dev.webp Autonomous Coding Agents: Where the Line Is An agent that plans, edits, runs and iterates on its own is impressive. The engineering question is what it is allowed to touch while it does that. https://omarbadran.dev/blog/langfuse-llm-observability 2026-08-12 yearly 0.6 https://omarbadran.dev/img/blog-v2/langfuse-llm-observability.webp You Cannot Debug an LLM Feature You Cannot See Traces, prompt versions and evaluation scores for AI features. Without them, 'it gave a bad answer' is a bug report with no reproduction steps. https://omarbadran.dev/blog/browser-use-agents 2026-08-12 yearly 0.6 https://omarbadran.dev/img/blog-v2/browser-use-agents.webp Agents That Drive a Browser: Useful and Dangerous Letting a model click through a real website solves problems no API covers. It also hands a language model your session cookies — here is how to scope that. https://omarbadran.dev/blog/claude-cookbooks-patterns 2026-08-11 yearly 0.6 https://omarbadran.dev/img/blog-v2/claude-cookbooks-patterns.webp The Patterns Worth Stealing From the Claude Cookbooks Runnable notebooks beat prose about prompting. The four patterns in there that changed how I build features on top of a model. https://omarbadran.dev/blog/litellm-gateway 2026-08-11 yearly 0.6 https://omarbadran.dev/img/blog-v2/litellm-gateway.webp One Gateway in Front of Every Model A proxy that speaks one API to your app and many APIs to providers. The value is not switching models — it is the key handling, budgets and logs you get for free. https://omarbadran.dev/blog/lucide-icon-system 2026-08-10 yearly 0.6 https://omarbadran.dev/img/blog-v2/lucide-icon-system.webp Icons Are a System, Not a Folder of SVGs Consistent stroke weight, one grid, tree-shakeable imports, and the accessibility rule that decides whether an icon should be announced at all. https://omarbadran.dev/blog/claude-code-agentic-terminal 2026-08-10 yearly 0.6 https://omarbadran.dev/img/blog-v2/claude-code-agentic-terminal.webp Claude Code: What Changes When the Agent Has a Terminal An assistant that can read the repo, run the tests and see the failure is a different tool from one that autocompletes. Here is how I actually use it, and where I do not. https://omarbadran.dev/blog/react-three-fiber-3d 2026-08-09 yearly 0.6 https://omarbadran.dev/img/blog-v2/react-three-fiber-3d.webp React Three Fiber: 3D Without Leaving React Three.js as components, with the reconciler doing the scene-graph bookkeeping. The hard part was never the code — it is deciding whether the page needs 3D at all. https://omarbadran.dev/blog/million-react-compiler 2026-08-09 yearly 0.6 https://omarbadran.dev/img/blog-v2/million-react-compiler.webp Before You Reach for a Faster React Compilers that speed up React rendering are real and clever. They also solve the second-biggest problem on most pages — here is how to find out if you have the first one. https://omarbadran.dev/blog/jotai-atomic-state 2026-08-08 yearly 0.6 https://omarbadran.dev/img/blog-v2/jotai-atomic-state.webp Jotai: State That Only Wakes Who Needs It Bottom-up atoms instead of a single store. Derived state is a computed atom, and only the components reading a changed atom re-render. https://omarbadran.dev/blog/tanstack-router-typed-routes 2026-08-08 yearly 0.6 https://omarbadran.dev/img/blog-v2/tanstack-router-typed-routes.webp Type-Safe Routing: No More Guessing Params If a route's params and search schema are typed, a broken link becomes a compile error instead of a blank page someone finds in production. https://omarbadran.dev/blog/storybook-component-contracts 2026-08-07 yearly 0.6 https://omarbadran.dev/img/blog-v2/storybook-component-contracts.webp Storybook Is a Contract, Not a Gallery The value is not the pretty component browser. It is that every state a component can be in has to be written down, and the ugly ones stop being discovered in production. https://omarbadran.dev/blog/hono-edge-api 2026-08-07 yearly 0.6 https://omarbadran.dev/img/blog-v2/hono-edge-api.webp Hono: An API That Runs Anywhere Built on Web Standards rather than Node APIs, so the same handler runs on Node, Bun, Deno, Cloudflare Workers and Lambda. Small, typed and genuinely fast. https://omarbadran.dev/blog/tailwind-v4-engine 2026-08-06 yearly 0.6 https://omarbadran.dev/img/blog-v2/tailwind-v4-engine.webp Tailwind 4: The Config File Is Gone Design tokens moved into CSS itself. That sounds cosmetic until you realise it means your theme is readable by every tool that understands a stylesheet. https://omarbadran.dev/blog/vite-build-speed 2026-08-06 yearly 0.6 https://omarbadran.dev/img/blog-v2/vite-build-speed.webp Vite: Why the Dev Server Feels Instant It does not bundle during development. Understanding that one decision explains the speed, the plugin model, and the two places it still surprises people. https://omarbadran.dev/blog/sonner-toast-ux 2026-08-05 yearly 0.6 https://omarbadran.dev/img/blog-v2/sonner-toast-ux.webp Toasts Nobody Hates Toast notifications are usually an accessibility failure with a nice animation. Getting them right is mostly about knowing when not to use one. https://omarbadran.dev/blog/shiki-syntax-highlighting 2026-08-05 yearly 0.6 https://omarbadran.dev/img/blog-v2/shiki-syntax-highlighting.webp Shiki: Syntax Highlighting With Zero Runtime Highlight code at build time with the same engine your editor uses. The visitor downloads coloured HTML instead of a highlighting library and a grammar bundle. https://omarbadran.dev/blog/dnd-kit-accessible-drag 2026-08-04 yearly 0.6 https://omarbadran.dev/img/blog-v2/dnd-kit-accessible-drag.webp dnd-kit: Drag and Drop That Works Without a Mouse Most drag-and-drop implementations are unusable by keyboard and silent to screen readers. This one ships both, and it is lighter than what it replaces. https://omarbadran.dev/blog/nuqs-url-state 2026-08-04 yearly 0.6 https://omarbadran.dev/img/blog-v2/nuqs-url-state.webp Put Filter State in the URL, Not in useState If a filtered view cannot be bookmarked, shared or reloaded, it is a bug — not a design choice. nuqs makes the URL the state, with types. https://omarbadran.dev/blog/tanstack-table-headless 2026-08-03 yearly 0.6 https://omarbadran.dev/img/blog-v2/tanstack-table-headless.webp TanStack Table: Stop Rewriting Sorting and Pagination It renders nothing. That is the point — you get sorting, filtering, grouping and pagination as logic, and the markup stays yours. https://omarbadran.dev/blog/motion-react-animation 2026-08-03 yearly 0.6 https://omarbadran.dev/img/blog-v2/motion-react-animation.webp Motion: Animation That Respects the User Declarative animation in React, layout transitions that would take an afternoon by hand, and a reduced-motion story that is one hook rather than an audit finding. https://omarbadran.dev/blog/react-hook-form-uncontrolled 2026-08-02 yearly 0.6 https://omarbadran.dev/img/blog-v2/react-hook-form-uncontrolled.webp React Hook Form: Fewer Renders, Fewer Bugs Controlled inputs re-render the form on every keystroke and give you nothing for it. Uncontrolled forms with a validation schema are faster and shorter at the same time. https://omarbadran.dev/blog/radix-primitives-a11y 2026-08-02 yearly 0.6 https://omarbadran.dev/img/blog-v2/radix-primitives-a11y.webp Radix Primitives: Behaviour Without the Look Every custom dropdown I have audited had the same six accessibility bugs. Radix ships the keyboard handling and focus management unstyled, so you keep your design and lose the bugs. https://omarbadran.dev/blog/tanstack-query-server-state 2026-08-01 yearly 0.6 https://omarbadran.dev/img/blog-v2/tanstack-query-server-state.webp Stop Putting Server Data in useState Most React state bugs are one mistake wearing different hats: treating a copy of the server's data as if you owned it. TanStack Query fixes the category, not the symptom. https://omarbadran.dev/blog/zustand-state-without-boilerplate 2026-08-01 yearly 0.6 https://omarbadran.dev/img/blog-v2/zustand-state-without-boilerplate.webp Zustand: State Management You Can Read in One Sitting A store is a hook. That is the whole idea. No providers, no actions file, no reducer ceremony — and it scales further than the ceremony did. https://omarbadran.dev/blog/ollama-local-models 2026-07-28 yearly 0.6 https://omarbadran.dev/img/blog/ollama-local-models.webp Ollama: Run Real Models on Your Own Machine One command pulls a model and serves it on localhost. For prototyping, private data, and never paying per token again. https://omarbadran.dev/blog/claude-code-skills 2026-07-24 yearly 0.6 https://omarbadran.dev/img/blog/claude-code-skills.webp Turn Your Workflow Into a Claude Skill Prompting the same instructions every session is a waste. A skill is a folder that teaches the model how you work — once — and it pays back on every project after that. https://omarbadran.dev/blog/llama-cpp-quantization 2026-07-21 yearly 0.6 https://omarbadran.dev/img/blog/llama-cpp-quantization.webp llama.cpp and the Quantization You Actually Need Q4, Q5, Q8 — the difference between a model that fits your GPU and one that does not, explained without the maths. https://omarbadran.dev/blog/subagent-team 2026-07-17 yearly 0.6 https://omarbadran.dev/img/blog/subagent-team.webp Building a Subagent Team That Reviews Its Own Work One agent writing code is autocomplete. Several specialists who critique and correct each other is a process — and the difference shows up in the diff. https://omarbadran.dev/blog/vllm-serving-throughput 2026-07-14 yearly 0.6 https://omarbadran.dev/img/blog/vllm-serving-throughput.webp vLLM: When You Outgrow One Request at a Time Continuous batching and paged attention are why a serving stack handles fifty concurrent users on hardware that choked on five. https://omarbadran.dev/blog/claude-md-that-works 2026-07-09 yearly 0.6 https://omarbadran.dev/img/blog/claude-md-that-works.webp Writing a CLAUDE.md the Model Actually Follows Most project instruction files are wish lists. The ones that work read like a senior engineer briefing a new hire on day one — specific, ordered, and short. https://omarbadran.dev/blog/open-webui-chat-ui 2026-07-07 yearly 0.6 https://omarbadran.dev/img/blog/open-webui-chat-ui.webp Open WebUI: A Chat Front-End Your Client Can Actually Use Local models are useless to a business until someone non-technical can talk to them. This is the missing half. https://omarbadran.dev/blog/portfolio-that-converts 2026-06-30 yearly 0.6 https://omarbadran.dev/img/blog/portfolio-that-converts.webp Your Portfolio Is a Product, Not a Gallery A grid of screenshots tells a client what you touched. A case study tells them what you decided — and decisions are the only thing they are actually buying. https://omarbadran.dev/blog/whisper-speech-to-text 2026-06-30 yearly 0.6 https://omarbadran.dev/img/blog/whisper-speech-to-text.webp Whisper: Transcription That Handles Arabic Most speech-to-text falls apart on Arabic dialects. Here is what actually works, and where it still struggles. https://omarbadran.dev/blog/comfyui-node-pipelines 2026-06-23 yearly 0.6 https://omarbadran.dev/img/blog/comfyui-node-pipelines.webp ComfyUI: Image Generation as a Pipeline, Not a Prompt Box Nodes and graphs look intimidating until you need the same result twice. Then they are the only sane option. https://omarbadran.dev/blog/rtl-first-arabic 2026-06-21 yearly 0.6 https://omarbadran.dev/img/blog/rtl-first-arabic.webp Arabic-First, Not Arabic-Translated Flipping a layout to RTL is twenty minutes of CSS. Making an Arabic interface feel native is a different job entirely — and users notice the gap immediately. https://omarbadran.dev/blog/aider-terminal-pair 2026-06-16 yearly 0.6 https://omarbadran.dev/img/blog/aider-terminal-pair.webp Aider: AI Pair Programming That Commits It edits your repo and writes the commit message. Which is either exactly what you want or a very good reason to work on a branch. https://omarbadran.dev/blog/own-your-name-seo 2026-06-12 yearly 0.6 https://omarbadran.dev/img/blog/own-your-name-seo.webp Owning Your Own Name in Search If someone searches your name after a meeting, whatever they find becomes your reference check. Here is the exact stack I used to make sure they find me. https://omarbadran.dev/blog/continue-dev-assistant 2026-06-09 yearly 0.6 https://omarbadran.dev/img/blog/continue-dev-assistant.webp Continue: An Open-Source Coding Assistant You Control Point it at a local model, a cloud model, or both. The value is choosing where your code goes. https://omarbadran.dev/blog/llms-txt-geo 2026-06-03 yearly 0.6 https://omarbadran.dev/img/blog/llms-txt-geo.webp Getting Cited by AI Answer Engines People ask a model about you before they open a search engine. Generative engine optimisation is mostly just being unambiguous in machine-readable ways. https://omarbadran.dev/blog/mcp-servers 2026-06-02 yearly 0.6 https://omarbadran.dev/img/blog/mcp-servers.webp Model Context Protocol: Stop Writing Bespoke Tool Glue One protocol so any assistant can talk to your database, your files, your ticketing system. Write the server once. https://omarbadran.dev/blog/whatsapp-checkout 2026-05-26 yearly 0.6 https://omarbadran.dev/img/blog/whatsapp-checkout.webp When the Best Checkout Is No Checkout I built a storefront with no payment gateway on purpose. In the right market, a well-formed WhatsApp message converts better than any card form you can design. https://omarbadran.dev/blog/langchain-when-to-use 2026-05-26 yearly 0.6 https://omarbadran.dev/img/blog/langchain-when-to-use.webp LangChain: When the Framework Helps and When It Hurts For a three-step chain, the raw SDK is shorter and clearer. For an agent with twelve tools and retries, it is not. https://omarbadran.dev/blog/llamaindex-rag 2026-05-19 yearly 0.6 https://omarbadran.dev/img/blog/llamaindex-rag.webp LlamaIndex: RAG Beyond the Toy Example Chunking strategy decides whether your retrieval works. Everything else is a distant second. https://omarbadran.dev/blog/security-by-design-small-teams 2026-05-18 yearly 0.6 https://omarbadran.dev/img/blog/security-by-design-small-teams.webp Security by Design When You Are the Whole Team You do not get a security review, a pentest budget, or a second pair of eyes. What you get is the ability to make the cheap decisions early — before they become expensive. https://omarbadran.dev/blog/qdrant-vector-search 2026-05-12 yearly 0.6 https://omarbadran.dev/img/blog/qdrant-vector-search.webp Qdrant: Picking a Vector Database Without the Hype Filtered search is the feature that decides this, not raw benchmark numbers nobody reproduces. https://omarbadran.dev/blog/llm-proxy-pii 2026-05-08 yearly 0.6 https://omarbadran.dev/img/blog/llm-proxy-pii.webp Never Put Your API Key in the Browser Every AI feature I ship sits behind a server proxy that redacts personal data before it leaves the building. Here is the shape of that proxy, and why each part exists. https://omarbadran.dev/blog/n8n-ai-automation 2026-05-05 yearly 0.6 https://omarbadran.dev/img/blog/n8n-ai-automation.webp n8n: Automation That Survives the Client Handover A workflow the client can see and edit beats a cron job only you understand. https://omarbadran.dev/blog/email-otp-2fa 2026-04-28 yearly 0.6 https://omarbadran.dev/img/blog/email-otp-2fa.webp Email OTP That Is Not Security Theatre One-time codes are easy to add and easy to get wrong. Six digits with no rate limit, no expiry, and a leaky error message is worse than no second factor at all. https://omarbadran.dev/blog/dify-llmops 2026-04-28 yearly 0.6 https://omarbadran.dev/img/blog/dify-llmops.webp Dify: Giving Non-Developers a Safe AI Playground Prompt versioning, logs, and spend limits — the boring parts that make an AI feature survive contact with a real team. https://omarbadran.dev/blog/ragas-eval 2026-04-21 yearly 0.6 https://omarbadran.dev/img/blog/ragas-eval.webp Ragas: You Cannot Improve a RAG You Do Not Measure Faithfulness, relevance, context precision. Three numbers that turn "it feels better" into a decision. https://omarbadran.dev/blog/image-heavy-cwv 2026-04-16 yearly 0.6 https://omarbadran.dev/img/blog/image-heavy-cwv.webp Core Web Vitals on an Image-Heavy Site Photography studios, interior designers, florists — my clients sell with pictures. Making those sites fast is a constraint problem, not a plugin you install. https://omarbadran.dev/blog/unsloth-finetuning 2026-04-14 yearly 0.6 https://omarbadran.dev/img/blog/unsloth-finetuning.webp Unsloth: Fine-Tuning on Hardware You Already Have Before you fine-tune anything, read the part about why your problem is probably a retrieval problem. https://omarbadran.dev/blog/openai-agents-patterns 2026-04-07 yearly 0.6 https://omarbadran.dev/img/blog/openai-agents-patterns.webp Agent Patterns That Survive Production Loop limits, tool timeouts, and a hard budget. An agent without these is an outage with a personality. https://omarbadran.dev/blog/self-host-fonts 2026-04-05 yearly 0.6 https://omarbadran.dev/img/blog/self-host-fonts.webp Self-Host Your Fonts. All of Them. Two link tags to a font CDN cost you a DNS lookup, a connection, a redirect chain, and a layout shift — on the most visible text on the page. https://omarbadran.dev/blog/owasp-llm-top-10 2026-03-31 yearly 0.6 https://omarbadran.dev/img/blog/owasp-llm-top-10.webp The OWASP LLM Top 10, Translated Into Actual Fixes Prompt injection, insecure output handling, excessive agency. Each one with the line of code that prevents it. https://omarbadran.dev/blog/client-monorepo 2026-03-24 yearly 0.6 https://omarbadran.dev/img/blog/client-monorepo.webp One Monorepo Per Client Public site, admin dashboard, API. Three apps that must agree on types and ship together. Splitting them across three repos is how small teams create integration bugs. https://omarbadran.dev/blog/prompt-injection-defense 2026-03-24 yearly 0.6 https://omarbadran.dev/img/blog/prompt-injection-defense.webp Prompt Injection Is Not a Prompt Problem You cannot instruct your way out of it. The fix is architectural: assume the model will be turned against you. https://omarbadran.dev/blog/garak-llm-scanner 2026-03-17 yearly 0.6 https://omarbadran.dev/img/blog/garak-llm-scanner.webp Garak: Scan Your LLM App Before Someone Else Does A vulnerability scanner aimed at model behaviour — jailbreaks, leakage, toxicity — run in CI like any other test. https://omarbadran.dev/blog/case-studies-not-screenshots 2026-03-11 yearly 0.6 https://omarbadran.dev/img/blog/case-studies-not-screenshots.webp Write Case Studies, Not Screenshots The five-part structure I use for every project write-up, and the one question that decides whether a paragraph stays in or gets cut. https://omarbadran.dev/blog/pyrit-red-teaming 2026-03-10 yearly 0.6 https://omarbadran.dev/img/blog/pyrit-red-teaming.webp Red-Teaming Your Own AI Feature An hour of structured attack attempts before launch is worth more than any amount of post-incident analysis. https://omarbadran.dev/blog/presidio-pii-redaction 2026-03-03 yearly 0.6 https://omarbadran.dev/img/blog/presidio-pii-redaction.webp Presidio: Redaction That Beats Your Regex My hand-rolled patterns caught emails and phones. They missed everything shaped slightly differently. https://omarbadran.dev/blog/llm-guard-output 2026-02-24 yearly 0.6 https://omarbadran.dev/img/blog/llm-guard-output.webp Treat Model Output Like User Input Rendering generated text as HTML is XSS where the payload is written by a stranger through your own feature. https://omarbadran.dev/blog/model-supply-chain 2026-02-17 yearly 0.6 https://omarbadran.dev/img/blog/model-supply-chain.webp That Model File Is Executable Code Pickle-based checkpoints can run arbitrary code on load. Downloading weights from a random mirror is not neutral. https://omarbadran.dev/blog/agentic-ai-risk 2026-02-10 yearly 0.6 https://omarbadran.dev/img/blog/agentic-ai-risk.webp The Blast Radius of an Autonomous Agent Give an agent shell access and a budget, and you have built an insider threat that never sleeps. https://omarbadran.dev/blog/nuclei-templates 2026-02-03 yearly 0.6 https://omarbadran.dev/img/blog/nuclei-templates.webp Nuclei: Vulnerability Scanning You Can Read Templates are YAML. You can audit exactly what a check does before you run it against a client. https://omarbadran.dev/blog/semgrep-custom-rules 2026-01-27 yearly 0.6 https://omarbadran.dev/img/blog/semgrep-custom-rules.webp Writing a Semgrep Rule for Your Own Codebase The generic ruleset finds generic bugs. The rule you write for your own mistake finds it forever. https://omarbadran.dev/blog/trivy-container-scanning 2026-01-20 yearly 0.6 https://omarbadran.dev/img/blog/trivy-container-scanning.webp Trivy: One Scanner for Images, IaC and Dependencies Add it to CI in ten minutes. Then spend a week deciding which findings you are actually going to fix. https://omarbadran.dev/blog/osv-scanner-deps 2026-01-13 yearly 0.6 https://omarbadran.dev/img/blog/osv-scanner-deps.webp Your Dependency Tree Is Your Attack Surface A twelve-line utility can pull in ninety packages. Every one of them runs with your privileges. https://omarbadran.dev/blog/gitleaks-secret-scanning 2026-01-06 yearly 0.6 https://omarbadran.dev/img/blog/gitleaks-secret-scanning.webp The Secret You Committed Is Still in the History Deleting the line does nothing. Rotating the credential is the only fix, and a pre-commit hook is the only prevention. https://omarbadran.dev/blog/trufflehog-verified-secrets 2025-12-30 yearly 0.6 https://omarbadran.dev/img/blog/trufflehog-verified-secrets.webp Secret Scanning That Verifies Before It Alarms A scanner that tests whether a found key is live turns a thousand false positives into three real emergencies. https://omarbadran.dev/blog/zap-dast-ci 2025-12-23 yearly 0.6 https://omarbadran.dev/img/blog/zap-dast-ci.webp OWASP ZAP in CI Without Wrecking Your Pipeline A baseline scan on every pull request, a full scan nightly. Getting that split wrong is why teams turn DAST off. https://omarbadran.dev/blog/wazuh-siem-small 2025-12-16 yearly 0.6 https://omarbadran.dev/img/blog/wazuh-siem-small.webp A SIEM for Teams Who Cannot Afford a SOC Log collection you never read is theatre. Three alerts you actually respond to is a security programme. https://omarbadran.dev/blog/sigma-detection-rules 2025-12-09 yearly 0.6 https://omarbadran.dev/img/blog/sigma-detection-rules.webp Detection as Code with Sigma Rules Write the detection once in a vendor-neutral format, convert it to whatever your SIEM speaks. https://omarbadran.dev/blog/atomic-red-team 2025-12-02 yearly 0.6 https://omarbadran.dev/img/blog/atomic-red-team.webp Testing Whether Your Alerts Actually Fire Everyone deploys detection. Almost nobody verifies it triggers. Small, safe, mapped test cases fix that. https://omarbadran.dev/blog/falco-runtime-security 2025-11-25 yearly 0.6 https://omarbadran.dev/img/blog/falco-runtime-security.webp Runtime Security: Catching What the Scanner Missed A clean image can still spawn a shell at 3am. Build-time scanning cannot see that; runtime rules can. https://omarbadran.dev/blog/projectdiscovery-recon 2025-11-18 yearly 0.6 https://omarbadran.dev/img/blog/projectdiscovery-recon.webp Building a Recon Workflow With ProjectDiscovery Tools Subfinder into httpx into nuclei. Three tools, one pipe, and the whole external surface of an authorised target. https://omarbadran.dev/blog/sigstore-signing 2025-11-11 yearly 0.6 https://omarbadran.dev/img/blog/sigstore-signing.webp Signing Your Artifacts Without Managing Keys Keyless signing tied to your CI identity. The barrier to supply-chain integrity dropped to almost nothing. https://omarbadran.dev/blog/sbom-syft-grype 2025-11-04 yearly 0.6 https://omarbadran.dev/img/blog/sbom-syft-grype.webp An SBOM Is Just an Honest Inventory When the next Log4j lands, the only question that matters is "are we affected". An SBOM answers it in seconds. https://omarbadran.dev/blog/renovate-dependency-updates 2025-10-28 yearly 0.6 https://omarbadran.dev/img/blog/renovate-dependency-updates.webp Automating Dependency Updates Without Drowning Grouping, scheduling and auto-merge for patches. Otherwise you get forty pull requests and ignore all of them. https://omarbadran.dev/blog/github-actions-hardening 2025-10-21 yearly 0.6 https://omarbadran.dev/img/blog/github-actions-hardening.webp Your CI Has More Secrets Than Your Production Server Pin actions to a commit SHA, scope permissions per job, never run untrusted code on a privileged trigger. https://omarbadran.dev/blog/infisical-secrets 2025-10-14 yearly 0.6 https://omarbadran.dev/img/blog/infisical-secrets.webp Where Client Project Secrets Should Actually Live Not in the repo, not in a WhatsApp message, not in a .env you emailed. Here is the small-team answer. https://omarbadran.dev/blog/pre-commit-hooks 2025-10-07 yearly 0.6 https://omarbadran.dev/img/blog/pre-commit-hooks.webp The Pre-Commit Hooks Worth Installing Today Secret scan, formatter, linter, large-file guard. Four hooks that prevent the four most common self-inflicted wounds. https://omarbadran.dev/blog/docker-image-slimming 2025-09-30 yearly 0.6 https://omarbadran.dev/img/blog/docker-image-slimming.webp A Smaller Image Is a Smaller Attack Surface No shell, no package manager, no curl. Most of your CVE count comes from tools your app never uses. https://omarbadran.dev/blog/biome-toolchain 2025-09-23 yearly 0.6 https://omarbadran.dev/img/blog/biome-toolchain.webp Biome: Replacing Two Tools With One Fast One Linting and formatting in a single binary. On a mid-size project the difference is seconds versus instant. https://omarbadran.dev/blog/bun-runtime 2025-09-16 yearly 0.6 https://omarbadran.dev/img/blog/bun-runtime.webp Bun: Where It Wins and Where I Still Use Node Install speed and the test runner are genuinely great. Production deployment is where I stay conservative. https://omarbadran.dev/blog/astro-islands 2025-09-09 yearly 0.6 https://omarbadran.dev/img/blog/astro-islands.webp Astro: Ship Less JavaScript on Content Sites A marketing site does not need a hydrated framework on every page. Islands make that an architecture, not a compromise. https://omarbadran.dev/blog/shadcn-copy-paste-ui 2025-09-02 yearly 0.6 https://omarbadran.dev/img/blog/shadcn-copy-paste-ui.webp The Copy-Paste Component Model You own the file, so you can restyle it into a brutalist theme without fighting a library you cannot edit. https://omarbadran.dev/blog/playwright-e2e 2025-08-26 yearly 0.6 https://omarbadran.dev/img/blog/playwright-e2e.webp Playwright: The Only Tests Clients Ever Notice Unit tests protect you. End-to-end tests protect the checkout. Guess which one the client cares about. https://omarbadran.dev/blog/zod-runtime-validation 2025-08-19 yearly 0.6 https://omarbadran.dev/img/blog/zod-runtime-validation.webp TypeScript Types Vanish at Runtime Your compile-time safety does nothing to a malformed request body. One schema per route closes the gap.