Skip to content
ELTIGA.

Open to remote roles · contract or full-time

Ahmed Eltigani

I build software a team runs on every day, and I make it hard to break.

Sole developer of Express Ops, the operations platform a tour operator's team works in daily. Software engineering graduate and Certified Ethical Hacker, working across DevSecOps and AI-enabled full-stack development.

Email meSee the work
saved for the operations team by Express Ops (my estimate)
3–5hrs/day
routed for structured extraction in Viya
5LLM providers
for driver dispatch: WhatsApp, Telegram, Slack
3channels
audit, lint, tests, typecheck and build before every deploy
5CI gates
selected work4 featured · scroll to advance

Case files

file 01Sole developer

Express Ops

Operations platform that turns manifest photos into driver lists, double-booking checks and customer documents.

In daily use by the operations team

Next.js / TypeScript / Convex / Mistral OCR / Docker Compose / GitHub Actions

Open case file: Express Ops

architecture · from the repo docs

Express Ops architectureFour rows. First, the manifest pipeline: manifest photos are read by Mistral OCR, each result is reconciled against the footer totals printed on the image, failures and mismatches go to an editable review queue, and the output is exported as an XLSX driver list or DOCX lists. Second, the browser path: the browser talks to the public Convex URL through Cloudflare. Third, the server path: the Next.js server talks to Convex over the internal Docker network, which avoids the Cloudflare managed challenge. Fourth, the release path: a push or pull request runs dependency audit, lint, tests, typecheck and build; a push to main deploys over SSH to Docker Compose, and the sign-in endpoint is checked afterwards.Manifest pipelineManifest photosgrouped into a sessionMistral OCReach image is readFooter-total checkrows vs totals printed in the imageReview queuefailures and mismatches; edit inplace, undoExportsXLSX driver list, DOCX listsBrowser path · public URLsBrowserNEXT_PUBLIC_CONVEX_URLCloudflarepublic hostnameConvexself-hosted backendServer path · internal networkNext.js serverauth, queries, preloads, uploadsDocker networkbackend:3230 and backend:3231 noCloudflare challengeConvexsame backend, internal URLRelease · GitHub ActionsPush or PRevery push and every pull requestChecksaudit, lint, test, tsc, buildSSH deploypush to main only; same commitDocker ComposeConvex functions, stack rebuiltSign-in checkendpoint verified after release

file 02Builder

Viya

Multi-tenant B2B SaaS that turns raw manifests into reviewed passenger data, optimized routes and driver dispatch.

Early MVP, built as a product for tour agencies beyond a single customer

Next.js / TypeScript / Convex / Clerk / Python / FastAPI / Docling

Open case file: Viya

architecture · from the repo docs

Viya architectureThree rows. First, ingestion: an Excel or PDF manifest is uploaded as a tenant-scoped record, parsed by one of four providers (docling, native_sheet, mistral_ocr, llamaparse), then structured by an LLM router that uses minimax_m2_5_highspeed by default with a fallback chain across openai_gpt_4_1_mini, gemini_2_5_flash_lite, zai_glm and deepseek_chat. Second, operations: an admin reviews the rows, routes are generated only when every passenger location is resolved, drivers are dispatched over WhatsApp, Telegram or Slack, and inbound replies are resolved back to the tenant and dispatch. Third, the tenant boundary: Clerk organization context and Convex ownership guards are checked on every read and write, and channel credentials are encrypted before storage.Ingest · manifest to dataUploadExcel or PDF, stored as atenant-scoped recordParsedocling, native_sheet, mistral_ocr,llamaparse; spreadsheet fast pathLLM routerdefault: minimax_m2_5_highspeedfallback chain: openai_gpt_4_1_mini,gemini_2_5_flash_lite, zai_glm,deepseek_chatextracted passenger rowsOperate · review, route, dispatchReviewadmin corrects rows; map pin forambiguous placesRoutesblocked on missing, failed orambiguous geocodes Google or MapLibre+ OSRMDispatchWhatsApp, Telegram, Slack driver DMsDriver repliesinbound webhooks resolved to tenantand dispatchTenant boundaryClerkorganization contextConvex guardstenant ownership validated before anyread or writeTenant datachannel credentials encrypted beforestorage

file 03Author

Lietner

Leitner-system flashcards on a 3D desk. Free, open source, works offline, with optional sync.

Live at lietner.app · open source under the MIT license

TypeScript / Vite / three.js / GSAP / IndexedDB / Supabase

Open case file: Lietner

architecture · from the repo docs

Lietner architectureThree rows. First, the device, which is the source of truth: a DOM overlay drives a three.js desk rendered on demand, pure Leitner rules schedule cards on integer calendar days, and IndexedDB stores every deck and card with tombstones and dirty flags. Second, optional sync for signed-in accounts: the sync engine pushes dirty rows and pulls by a server-stamped cursor, Supabase Postgres enforces row-level security per account and SQL triggers cap timestamps at the server clock, and the auth SDK is only loaded when someone signs in. Third, offline and privacy: a service worker precaches the app so guest mode works offline, and telemetry is cookieless page views plus crash reports with card text scrubbed.Device · source of truthDOM overlayno UI framework; text mode withoutWebGLthree.js deskrenders on demand; GSAP cardanimationsLeitner rulespure functions; 1, 2, 4, 8, 16 dayboxesIndexedDBtombstones, dirty flags, monotoniceditspush dirty rows · pull by server_atOptional sync · signed-in accountsSync enginedebounced, on focus and reconnect; onetab at a timeSupabase Postgresrow-level security; triggers cap timeat the server clockAuthemail code or Google; SDK loads onlyon sign-inOffline and privacyService workerprecached app shell; guest mode worksofflineTelemetrycookieless page views; card textscrubbed from crash reports

file 04Author

Gravel

Guardrails for AI agents: scope validation, human approvals, emergency stop and an audit trail.

Rust workspace with a terminal UI

Rust / MCP / Terminal UI / Cargo workspace

Open case file: Gravel

architecture · from the repo docs

Gravel architectureThree rows. First, the gate: the agent proposes a tool call, the scope check extracts targets from the arguments and validates them against allow and block lists (violations are denied and logged), the operator approves or denies in the terminal UI, and approval yields a signed token. Second, execution: the MCP interceptor accepts only requests that carry the token, sends them over a stdio or HTTP transport, and the tool server runs them. Third, always on: an audit log records sessions, requests, approvals, denials, executions and scope violations, and an emergency stop halts new requests and pending work.Gate · before anything runsAgentmodel backend proposes a tool callScope checktargets extracted from arguments;allow and block lists, CIDROperator approvalqueued in the TUI overlay; approve ordenySigned tokenissued on approvalapproved requests onlyExecute · MCP layerMCP interceptorscope, risk and approval awareTransportstdio or HTTPTool serverruns only with a signed tokenAlways onAudit logsession, request, approval, denial,execution, scope violationsEmergency stopstop new requests; cancel or denypending work
processes5 more builds

Also built

release pathexpress ops ci/cd

Nothing ships red

Every push to Express Ops runs the same gates. Only the commit that passes all of them reaches the production host.

  1. Audit[pass] dependency audit
  2. Lint[pass] eslint
  3. Test[pass] unit tests
  4. Typecheck[pass] tsc
  5. Build[pass] production build
  6. Deploy[pass] ssh + sign-in check

Express Ops

  • [pass]Every push and PR runs a dependency audit, lint, unit tests, typecheck and a production build.
  • [pass]A green push to main deploys the same commit to the production host over SSH, then verifies the sign-in endpoint.
  • [pass]Recent audit failures (ip-address, undici advisories) were patched via lockfile-only updates.

Viya

  • [pass]Clerk authentication with tenant-scoped access controls in the Convex backend.
  • [pass]Sentry across browser, server and edge runtimes, plus the Python service, with documented privacy rules.
  • [pass]Separate local, staging and production stacks; local backend and dashboard bind to loopback only.

Lietner

  • [pass]Row-level security limits every account to its own rows; pgTAP tests prove the isolation in CI.
  • [pass]SQL triggers cap client timestamps at the server clock and make deletions final.
  • [pass]Telemetry is cookieless page views plus Sentry crash reports with card text scrubbed out; no ads, no data sales.

Gravel

  • [pass]Defensive by design: every tool request passes scope validation and operator approval before it runs.
  • [pass]Emergency stop and an audit trail of what ran.
  • [pass]Cargo workspace with format, clippy and test commands as the quality gate.
experience2 roles · 2 credentials

Service record

  1. Jul 2026 – present

    Express Rafting

    Freelance developer · Contract

    Sole developer of Express Ops for a tour operator. Express Ops is used daily by the operations team and saves roughly 3–5 hours a day.

  2. 2023 – 2024

    Fyluim

    UI/UX & front-end developer · Employee

    UI/UX design and front-end development at a company building web3 technologies and trading bots.

  3. Graduated 2026

    Nişantaşı University

    B.Sc. Software Engineering · Education

credential2026

CEH

Certified Ethical Hacker (CEH)

EC-Council · Earned 2026, currently valid

Self-paced

AWS Skill Builder training

Amazon Web Services · Training completed (not an AWS certification)

toolbox29 tools

Loadout

Product engineering09 loaded

  • TypeScript
  • React
  • Next.js
  • Convex
  • Tailwind CSS
  • UI/UX design
  • Python
  • Rust
  • Swift

DevSecOps06 loaded

  • GitHub Actions
  • Docker / Compose
  • Dependency auditing
  • Sentry
  • Clerk / RBAC
  • Ethical hacking (CEH)

AI & automation04 loaded

  • LLM extraction pipelines
  • OCR (Mistral, Docling, LlamaParse)
  • MCP servers
  • Agent guardrails

Infrastructure10 loaded

  • TCP/IP, IPv4/IPv6 subnetting
  • Routing (static, OSPF)
  • Switching (VLANs, STP, EtherChannel)
  • ACLs, NAT, DHCP, DNS
  • Linux CLI
  • Proxmox VE
  • VMware Workstation Pro
  • KVM
  • Home lab: DNS server, NAS, Jellyfin
  • Splunk / SIEM (learning)
aboutEnglish · Arabic · Turkish

Operator profile

I graduated in Software Engineering from Nişantaşı University in 2026. Before that I spent a year as a UI/UX and front-end developer at Fyluim, a web3 and trading-bot company.

Since July 2026 I've been the only developer on Express Ops for a tour operator. I wrote the first schema and I run the CI pipeline that deploys it. Most of my time goes to the parts users never see: audit gates, tenant isolation, observability and safe defaults.

I'm a Certified Ethical Hacker (EC-Council, 2026). I also build guardrails for AI agents: scope checks, human approvals and an emergency stop.

Networking is part of my toolkit too: subnetting, routing, switching and VLANs. At home I run a lab with a DNS server, a NAS and Jellyfin. I'm comfortable on the Linux command line, manage hypervisors in Proxmox and VMware Workstation Pro, have worked with KVM, and I'm currently learning SIEM work in Splunk.

Ahmed Eltigani smiling on a waterfront boardwalk
off duty

field logevents attended

  • Ahmed Eltigani wearing an attendee badge in front of the AWS Cloud and AI Day Türkiye backdrop

    AWS Cloud and AI Day TürkiyeAttendee · 2026

  • Ahmed Eltigani on stage in front of a Google for Developers Day: Istanbul screen showing the Bosphorus Bridge

    Google for Developers Day: IstanbulParticipant · 2026

  • Ahmed Eltigani wearing a TEKNOFEST lanyard in front of a green wall of plants and neon icons

    TEKNOFESTParticipant · 2023

open channelreplies by email

Hiring? Building something?

Email is the fastest way to reach me. Send the role, the contract or the project and what you need built.

Eltiga@protonmail.com