Skip to contentOpen to SWE internships
Open to software engineering internships

Backend and systems work, mostly Go and Python, mostly in the place where one program has to make a judgement about another. Guessing is cheap there. Being right is not.

aryanghai1205@gmail.comSee the proof

Backend & Systems Engineer · Greater Noida, India · Remote, or relocating within India

23
merged upstream
6
repos I do not own
28
public repos
2023
contributing since
0x01proof

23 pull requests merged into 6 repositories owned by other people, including Kubescape and OpenYurt, both CNCF projects. Reviewed by maintainers whose standards were not mine to set. Every row below links to the pull request itself.

23

Every one of them was reviewed by somebody who had no reason to be generous about it.

counted from the github api · measured 26 Aug 2026

the ones that were hard

10 Rego detection rules, merged into Kubescape

Each one maps a distinct Kubernetes privilege escalation primitive into policy that runs against real clusters: service account assignment, token issuance, privileged pod modification, node and pod status writes, namespace scoped remote execution, provider IAM assumption. They share a title format because they share a rule format, not because they are one contribution.

also merged

Not counted above: 2 further merges into Vanshikadahaliya/TouristSafety, a classmate’s project I worked on as part of the team. Real work, but not the same claim, so it does not get to inflate the number.

0x02work

Three systems, each one built around the same refusal: do not assert, execute. Each carries a working reduction of the real thing rather than a screenshot of it.

0x02.a06/2026 to present

Execution grounded code review and sandbox engine

AI code review that proves its findings before it opens its mouth. When it suspects a bug it writes a test that fails only if the bug is real, runs that test in a network isolated sandbox, applies its own suggested fix, and runs it again. When it suspects a security hole it writes a proof of concept and tries it.

  • Thirteen stages from webhook to posted review. A Go edge receiver verifies the signature and pushes to Redis Streams, and an orchestrator takes it from there.
  • A whole repository AST and semantic graph, built with Tree-sitter and pgvector, computes the blast radius of a change instead of guessing it. The call graph diagrams in the PR body are measured, never drawn by a model.
  • The execution layer runs on gVisor and Docker with zero network egress, and teardown is verified once per review.
  • Bring your own key across Anthropic, OpenAI and Google. Runs air gapped. Reviews pull requests on GitHub, GitLab, Bitbucket and Azure DevOps.
  • No emoji anywhere in its output, enforced by a test that fails the build if one gets in.
  • Go
  • Python
  • TypeScript
  • LangGraph
  • pgvector
  • Redis Streams
  • gVisor
  • Docker

Anything it cannot reproduce is dropped before a human ever sees it.

sourceCavix source on GitHub, opens in a new tabliveCavix running, opens in a new tab
Cavix · live reduction001
Cavix Reviewsuccess
review scope & effort
Deep Scan
2 subsystems · 3 changed regions · TypeScript
Symbol Scope
issueRefund, onWebhook
AST Verification
128 symbols resolved, cross-file impact mapped
Security Gate
1 exposure, highest critical
Execution Proof
1 of 4 findings reproduced, 3 discarded

Refund amount is taken from the untrusted webhook body

⬢ verifiedcriticalsecurity
sealed sandbox · no network egress
[repro]node --test webhook.exploit.test.mjsexit 0 exploit succeeded
[fix]applied suggested patch
[repro]node --test webhook.exploit.test.mjsexit 1 exploit blocked
[suite]node --testexit 0 suite still green
0x02.b08/2026 to present

Client side ATS resume x-ray and verification engine

A resume parser that never uploads your resume. PDF and DOCX are parsed and redrawn entirely in the browser on Web Workers, so the document never leaves the machine it was opened on.

  • The Parse X-ray redraws your document as the parser sees it. Every line sits at its true position, coloured by whether it was read cleanly, read with risk, or missed entirely. It catches the silent two column failure, which is the most common one there is.
  • A verifier runs after the model and enforces exact substring matching against the source text, so nothing can be reported as a skill, employer, date or metric unless it can be quoted.
  • Deterministic TypeScript scoring with published weights. Same document, same score, every run.
  • Stateless zero logging proxy for your own API key, AES-GCM encrypted browser storage, strict Content Security Policy.
  • The README states its non-goals first: no OCR, no outcome promises, no claim to be a real ATS.
  • Next.js
  • TypeScript
  • Web Workers
  • pdfjs-dist
  • mammoth
  • Docker

If it cannot quote you, it does not get to say it.

sourceTraceCV source on GitHub, opens in a new tab
TraceCV · live reduction002
Parse X-rayin-browser · nothing uploaded
  • read cleanly
  • read with risk
  • not read
trace
  • header · name read
  • contact block read
  • column split detected at y=30
  • sidebar read as separate stream
  • main column · experience
  • embedded graphic · no text layer
  • projects section read
0x02.c03/2026

CI/CD pipeline bottleneck analyser

Pulls live pull request data from any GitHub repository, engineers a statistical feature matrix, and runs K-Means to discover where a team actually stalls rather than assuming it. It answers "why is our pipeline slow" with a measurement instead of an opinion.

  • Features engineered from raw API data: time to merge, code churn, review friction, commits per file.
  • IQR outlier removal at a 3x fence, log1p on the right skewed features, z-score normalisation, then K-Means with nstart = 50 to avoid local minima.
  • k is validated by Elbow and Silhouette together, not chosen by eye. PCA is used for the 2D projection only.
  • Ships a full methodology tab with the K-Means objective, Lloyd’s algorithm and the silhouette formula written out.
  • Its default target is OWASP/BLT, so it analyses the pipeline I actually worked in.
  • R
  • Shiny
  • Plotly
  • httr2
  • K-Means
  • PCA
  • GitHub REST

Three personas fall out of the data: Fast Track, Average Churn, Review Black Hole.

sourceRepoPulse source on GitHub, opens in a new tab
RepoPulse · live reduction003
K-Means · PCA projectionunassigned
PC1 · time to mergePC2 · friction
  • Fast Track
  • Average Churn
  • Review Black Hole
objective

argmin Σ ‖x − μi‖²

k validated by elbow and silhouette · nstart = 50 · log1p then z-score

what actually got used

Edges weighted by bytes actually on disk

Edge thickness is the number of bytes GitHub measured in each repository, so a thin edge stays thin. Dashed edges are runtimes the project genuinely depends on but which have no source of their own to weigh.

  • measured · bytes on disk
  • declared · no bytes to weigh

RepoPulse is set to R by hand. GitHub reports it as 87% HTML because Shiny commits rendered output, which is technically sourced and materially false, so it does not get to be the badge.

  • Cavix

    • TypeScript2.04 MB
    • Go144 KB
    • JavaScript116 KB
    • Python
    • LangGraph
    • pgvector
    • Redis Streams
    • gVisor
    • Docker

  • TraceCV

    • TypeScript800 KB
    • Next.js
    • Web Workers
    • Docker

  • RepoPulse

    • R125 KB
    • Shiny
    • K-Means
    • GitHub REST
also built
0x03who

I write backend and systems software, mostly in Go and Python, and mostly in the space where a program has to make a judgement about other code. That turns out to be a place where confident guessing is very cheap and being right is expensive.

So the through line in everything below is the same. Do not assert, execute. A review tool that thinks it found a bug should write a test that fails only if the bug is real, run it in a sealed sandbox, apply the fix, and run it again. A resume parser that thinks it found a skill should be able to quote the line it came from, or stay quiet.

The rest of my time goes to open source. Most of what I shipped this year landed in repositories I do not own, reviewed by maintainers whose standards were not mine to set. That is the only code review that really tells you where you stand.

The honest version: I would rather be corrected by a failing test than believed by a reviewer who is being polite. Most of what I build is a way of arranging for that to happen automatically.

session · read onlyIST (UTC+5:30)
aryan@index~ %whoami
name
Aryan Ghai
role
Backend & systems engineer
edu
NIET, Greater Noida · B.Tech CSE · 9.22 / 10
now
Open Source Intern, OWASP Foundation
thesis
Verification over assertion
aryan@index~ %
  1. 05/2026 to 08/2026

    OWASP Foundation

    Open Source Intern · Remote

    Designed the architecture for BLT-Toasty, an AI triage and responsible disclosure assistant for the OWASP Bug Logging Tool. Its central invariant is a fail closed redaction gate: no model inference and no vector embedding can execute until Microsoft Presidio has cleared the payload, and any failure at all, whether a timeout, a parse error or low confidence, quarantines the event instead of letting it through. I wrote the twelve week delivery roadmap and the tracked issues against it, and shipped production Python and Rails into the wider OWASP BLT ecosystem through maintainer review.

    • Python
    • Cloudflare Workers
    • Docker
    • Ruby on Rails
  2. 2023 to present

    Noida Institute of Engineering and Technology

    B.Tech, Computer Science

    CGPA 9.22 / 10 · data structures, algorithms, object oriented design

0x04toolkit

Grouped by where it sits in the stack rather than by how confident I am about it, and the two things I would call basic say so.

  1. 01

    languages

    • Go
    • Python
    • TypeScript
    • JavaScript
    • Java
    • SQL
    • C
    • Rubybasic
    • R
    • Solidity
  2. 02

    backend & systems

    • microservices
    • concurrency
    • REST
    • Redis Streams
    • PostgreSQL
    • pgvector
    • memory management
  3. 03

    infra & runtime

    • Docker
    • gVisor
    • Kubernetesbasic
    • Cloudflare Workers
    • Linux
    • Bash
    • Git
    • Azurebasic
  4. 04

    ai systems

    • LangGraph
    • Tree-sitter
    • BYOK routing
    • Anthropic
    • OpenAI
    • Gemini
  5. 05

    quality

    • PyTest
    • go test
    • integration testing
    • CI/CD
    • Rego / OPA
    • code review
0x05

Andy DufresneThe Shawshank Redemption, 1994

Every tool on this page exists because something did not work and could have. That is the whole job: refusing to accept that the failing thing has to keep failing.

0x06contact

Open to software engineering internships.

Email is the fastest way to reach me, and it is written out below in plain text rather than hidden behind anything. Everything I have built or contributed to is linked here and open to inspection, which is the point.

aryanghai1205@gmail.com
availableGreater Noida, IndiaIST (UTC+5:30)
$ git remote -v
contact · interactivetype or click

Six commands. Try help, or just press a chip.