Secure, measured, honest with data
Backend core of a medical transcription and clinical-documentation platform used by doctors, plus the web app, analytics dashboard, browser extension and desktop app around it. I made it faster, closed security holes, and stopped the product from showing fake numbers.
- Audio pipeline: async ffmpeg and one probe per chunk instead of two, giving 3.7× throughput at 4 concurrent chunks and 74–118 ms less event-loop blocking per chunk
- Chunk join: numerals match only number words of the same value, Egyptian Arabic spellings included, like تلاتة and تمانين. Rebuilding at the 120-chunk cap went from 42 s to 0.3 s of event-loop time, and log lines from ~7,300 to 238
- Closed privilege escalation: org admins could grant themselves system_admin, revokes were never checked, DELETE /user/:id had no org scoping, suspended users' tokens kept working
- Found every /api/speaker-verification/* endpoint unauthenticated, then reworked voice enrollment: no audio stored, fingerprint out of the audit log, voiceprint deletion confirmed before rows are removed
- Hardening: global error handler (~35 catch blocks leaked Postgres/OpenAI errors), login timing oracle closed, a shared “[object Object]” rate-limit bucket fixed, a router-walking test that fails any route without auth, per-commit releases with automatic rollback, an 86-variable env schema
- No fake data: one metric engine where every value is live | partial | proposed, so the UI says “not instrumented” instead of 0; confidence shows null, not “0.0%”
- Clients: SDAIA/PDPL compliance screen and a safe “keep me signed in” in the browser extension, Arabic RTL chat, ONNX wake-word detection on desktop, and an Opus encoder fix for the 72 ms lost at every chunk join
Integrations: PostgreSQL · OpenAI · ffmpeg · Opus · ONNX · React Query






