# Syed Tasavour

> AI Engineer and Full Stack Developer in Budgam, Jammu & Kashmir, India. AI Engineer and Full Stack Developer. SaaS and web apps. Building production systems since 2019.

I work out what should actually get built, then build the whole of it. Kashmir Student Alerts, built for a client, has run since 2019. Postlyo was acquired.

## Contact

- Hire / enquiries: https://www.upwork.com/freelancers/~01fae35763db926a69 (Upwork)
- Site: https://syedtasavour.com

## Experience

- **Beneathatree** — Full Stack Developer, Jun 2025 — Present (Bangalore, India). Keeps a senior-living company's software running, the app and the website and the TVs in each building and the Alexa units in the rooms, so residents, families and staff can reach each other. Also made its alerts reliable enough to trust, and moved the reporting data onto something faster with nothing taken offline.
- **Simmature** — Full Stack Developer, Mar 2025 — Jun 2025 (Remote, India). Built the engine behind a professional networking site: profiles, feeds, connections, and messaging that keeps working with a thousand people talking at once. Also set up signing in with Google and LinkedIn, added two-step verification, and made sure its texts and emails actually get delivered.
- **Unified Mentor** — Full Stack Developer Intern, Oct 2024 — Nov 2024 (Remote, India). Made a study platform suggest what to learn next based on the individual student, instead of showing everyone the same list. Also made the site about a quarter faster to use, and built the live chat that runs on it.
- **Exposys** — Full Stack Developer Intern, Sep 2024 — Oct 2024 (Bangalore, India). Built a travel booking site from scratch, two thousand places to stay with maps, guest accounts and reviews, and put it on hosting that stays up and copes on its own when a lot of people arrive at once.

## Selected work

- [Postlyo](https://syedtasavour.com/work/postlyo) — Running a blog properly means a CMS, an SEO plugin, an analytics script, a paywall tool and hosting. Five accounts, five bills, five places to break, before a word is written. Postlyo put those in one multi-tenant system. The engineering question was never features, it was isolation: one endpoint missing a tenant filter shows one customer another customer's unpublished drafts, and you find out from the customer. So tenancy is enforced at the data layer rather than trusted to each query. What did not get built was a page builder, because every publishing product drifts toward one and it eats the roadmap permanently. Built with Next.js 16, Fastify, PostgreSQL, Redis, Drizzle ORM.
- [Kashmir Student Alerts](https://syedtasavour.com/work/kashmir-student-alerts) — Exam results in Kashmir do not trickle out. A board publishes, word spreads, and inside two minutes essentially every student in the region is on the same page looking for their number. The rest of the week it is quiet. That is the whole engineering problem, and it is why the obvious answer was wrong: a server sized for the normal day falls over on the only day anyone judges you on, and sizing for the peak means paying for it on the 360 days it never arrives. The parts that spike scale to zero between events and the read path is cached hard, because during a spike almost every request is the same request. There is no account, no feed, no personalisation. Each was considered, and each adds something to fail on the day the site cannot afford to fail. Built with Node.js, Redis, MongoDB, Socket.IO, AWS.
- [Airlock](https://syedtasavour.com/work/airlock) — You run an install. A package you have never heard of, four levels down the tree, runs a postinstall script with your permissions. It can read your SSH keys and your cloud credentials. Most developers know this and install anyway, because the alternative is inconvenient enough that nobody does it. Airlock makes it convenient: read-only root, dropped capabilities, egress denied by default, and a short allowlist of the hosts a build actually needs. Defaulting to deny is the decision that matters. A sandbox you have to configure before it protects you gets configured once, permissively, and then forgotten. Built with Docker, Shell, tinyproxy, Linux.
- [Statemint](https://syedtasavour.com/work/statemint) — Bank statements arrive as password-protected PDFs. Somebody opens one, opens a spreadsheet next to it, and types. Every month. The tools offering to fix this ask you to upload the statement to their server, or hand over your banking login so they can fetch it themselves. For anyone who understands what is being asked for, that is where the conversation ends. Statemint reads Gmail read-only and parses on the machine it runs on. Nothing is uploaded. The hard part was not parsing but drift: every bank formats differently and changes without telling anyone, so it fails loudly and skips a row it cannot read rather than confidently producing a wrong number. A missing line is visible. A wrong balance is not. Built with JavaScript, React, AWS Serverless, Cognito, KMS.
- [SimulAPI](https://syedtasavour.com/work/simulapi) — The backend is not ready and the frontend team is idle. The usual response is that everyone writes their own mock, so now there are four mocks that disagree with each other and with the spec, and integration day is where you find out. SimulAPI turns an OpenAPI spec into a running, validating mock in under a minute. It validates because a mock that accepts anything lets you build against a contract you are already breaking. There is no persistence layer and no scripted stateful behaviour, deliberately: the moment a mock has its own state model it becomes a second implementation of your backend, and teams end up debugging the mock. Built with TypeScript, Next.js, MongoDB, OpenAPI.
- [SupplyGuard](https://syedtasavour.com/work/supplyguard) — Dependencies move faster than any team can read them. The upgrade that becomes an incident is never the one anybody discussed, it is the patch bump nobody opened. SupplyGuard watches what is changing underneath a repository and flags what deserves a human. It stores no source code, which was the first decision and not a negotiable one: a tool asking for repository access has to be able to answer what it keeps, and the only answer that survives a security review is nothing. Built with TypeScript, Next.js, PostgreSQL, GitHub Apps.
- [GeoTagCamera](https://syedtasavour.com/work/geotagcamera) — A field engineer photographs a completed installation. A driver photographs a delivery. An assessor photographs damage. The photo is proof only while the location travels with it, and every messaging app strips that metadata on send. By the time it reaches the person who needs it, it is a picture of a wall. The fix is not clever: stop treating location as metadata. Coordinates, address, time and date are drawn into the pixels, so the evidence survives WhatsApp, email, a screenshot and a print. What that gives up is the ability to change the stamp afterwards. That was fine to lose. If the stamp can be removed later, the photo was never proof. Built with React Native, Android SDK, Skia Canvas, Appwrite, Mapbox.
- [NewsForge](https://syedtasavour.com/work/newsforge) — A newsroom needs two things most publishing software makes you trade against each other: publish quickly, and rank. Server rendering settled it. Pages arrive complete, so a crawler is not waiting on JavaScript to find the article and the reader on a slow connection sees text rather than a spinner. That came before any editorial feature, because retrofitting it later means rewriting the front end. There is an assistant for the drafting stages. It suggests and it does not publish, and the guardrail is that it never has that permission in the first place. Built with Next.js, SSR/ISR, MongoDB, OpenAI API, Sharp.
- [Kashmir Student Alerts](https://syedtasavour.com/work/kashmir-student-alerts-app) — The Android side of the same platform. A student who has already missed one result notification does not want to remember to check a website, so the app exists to do one thing: land the alert on the lock screen and open straight to it. Everything that would have made it a richer app would also have made it a slower one on the cheap devices most of its users actually have. Built with Android, Java, Kotlin, Firebase, Material Design.
- [GhostFrame](https://syedtasavour.com/work/ghostframe) — Windows users get background blur and replacement from their graphics vendor. On Linux nobody was going to ship it, because the market does not justify the driver work. GhostFrame runs segmentation on the live stream and then presents itself to the system as an ordinary camera device. That last part is the whole design: every video app already knows how to open a camera, so nothing needs a plugin, an integration or the vendor's cooperation. The constraint was time. Segmentation has to finish inside a frame budget or you are shipping a stutter, and a call with a stutter is worse than a visible bedroom. Built with Python, Computer Vision, Linux, V4L2.
- [Portfolio Platform](https://syedtasavour.com/work/portfolio-platform) — The system behind my own work: publishing, documentation, invoices and client records in one place instead of four subscriptions that do not talk to each other. The honest description is a lot of surface area held by one person, and the interesting constraint was maintenance rather than construction. Anything built here I also have to keep running forever, alone, alongside client work. That ruled out a great deal that would have been fun to build. Built with React 18, Node.js, Express.js, Appwrite, Redux Toolkit.
- [Vehicost](https://syedtasavour.com/work/vehicost) — Ask someone what their vehicle costs per kilometre and they will guess. The real answer is spread across fuel receipts, service bills, insurance, tyres and a dozen small expenses nobody writes down. Vehicost is a ledger that produces one number. The design constraint was that logging a fill-up has to take seconds at the pump, on a phone, with one hand, or nobody logs anything and the number is wrong. Everything else was subordinate to that. Built with TypeScript, Next.js, MongoDB, Tailwind CSS.

Full index: https://syedtasavour.com/#work

## Writing

- [Matter.js calls preventDefault on every touch, and traps your page](https://syedtasavour.com/journal/matter-js-preventdefault-traps-page-scroll) — A physics toy on a phone stopped the page scrolling. Not when you touched an object — when you touched anywhere near it. (2026-08-06)
- [A portalled <dialog> does not fire React's onClose](https://syedtasavour.com/journal/a-portalled-dialog-does-not-fire-reacts-onclose) — Closing the modal left the app permanently frozen. The event was firing. React just was not listening for it. (2026-07-30)
- [Multi-tenant isolation belongs in the data layer, not in every query](https://syedtasavour.com/journal/multi-tenant-isolation-belongs-in-the-data-layer) — One endpoint missing a WHERE clause shows one customer another customer's drafts. You find out from the customer. (2026-07-23)
- [Designing for the spike, not the average](https://syedtasavour.com/journal/designing-for-a-spike-not-an-average) — A platform that is quiet for days and then serves an entire region inside two minutes. The load shape decided the architecture before any feature did. (2026-07-16)
- [Cloudflare was revalidating every hashed asset on every page load](https://syedtasavour.com/journal/cloudflare-workers-assets-caching-default) — Workers Assets ships a default cache header that is correct for hand-written files and wrong for every file a bundler emits. (2026-07-09)
- [setPointerCapture on pointerdown silently kills every click](https://syedtasavour.com/journal/setpointercapture-on-pointerdown-kills-your-click) — A draggable marquee where none of the cards were clickable. The drag code was correct. It was one line, in the wrong handler. (2026-07-02)
- [Never trust the delta your frame loop hands you](https://syedtasavour.com/journal/never-trust-the-delta-your-frame-loop-hands-you) — An unclamped frame delta made a WebGL hero teleport instead of resume, and pushed an interpolation past its target into negative values. (2026-06-25)
- [overflow-x: auto quietly makes a vertical scroll container too](https://syedtasavour.com/journal/overflow-x-auto-makes-a-vertical-scroll-container) — Three full-bleed carousels on a phone ate every upward swipe. The cause was one line of CSS that does something the property name does not say. (2026-06-18)

Feed: https://syedtasavour.com/feed.xml

## Usage and attribution

- Terms in English: https://syedtasavour.com/ai
- The same terms as JSON: https://syedtasavour.com/ai.json
- Everything on this site may be read, quoted, summarised, trained on, redistributed and used commercially.
- The one condition is attribution: name Syed Tasavour and link https://syedtasavour.com where the format allows a link.
- Nothing requires asking permission first. There is no use that gets a different answer.

## Notes

- Figures on this site are the ones its author stands behind; where two versions of a number existed, the newer is used.
- Project pages state what a system is, what it runs on and what it achieved. There is no invented narrative around them.
- Journal posts are Markdown stored in a database and served read-only; https://syedtasavour.com/api/journal returns the same content as JSON.
- Where a platform belongs to a client the text says so beside the figure. Do not restate a client's traffic as this author's.
- Full index of pages: https://syedtasavour.com/sitemap.xml