Skip to content
View samiali38183's full-sized avatar
:shipit:
Agentic securing
:shipit:
Agentic securing

Achievements

Achievement: Pull SharkAchievement: Quickdraw

Achievements

Achievement: Pull SharkAchievement: Quickdraw

Block or report samiali38183

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
samiali38183/README.md

Sami Ali

Cybersecurity student at George Mason University (B.S. Information Technology, cybersecurity minor, May 2028). CompTIA Security+ and AWS Certified Cloud Practitioner. Interned on the DHS/CBP Vulnerability Assessment Team in summer 2026. Studying for OSCP and the AWS Security Specialty. Northern Virginia. Looking for Summer 2027 security engineering internships.

Portfolio · Resume (PDF) · LinkedIn · samiali38183@gmail.com

Projects

tripline: a CI gate for detections. It runs ATT&CK techniques (Atomic Red Team on Linux and Windows runners, replayed Stratus Red Team and flaws.cloud logs for AWS), replays the telemetry through Sigma rules and fails the pull request when an expected rule stops firing. On its first Linux run the stock SigmaHQ setuid/setgid rule matched 0 of 36 recorded events; a custom rule closes the gap. 10 scenarios pass on recorded telemetry, 4 are pending, and prevalence-weighted coverage is 68%. Live report.

sinkline: a static analyzer for Python web apps that follows request data across functions and files to SQL, shell, SSRF and deserialization sinks, and maps findings to OWASP Top 10 and CWE. SARIF output, GitHub Action, no dependencies. On its own 109-line self-labeled benchmark: precision 1.000, recall 0.984, F1 0.992, against Bandit's F1 of 0.579. Sample report.

kevgate: a vulnerability-intake API that ranks findings by CISA KEV, EPSS, CVSS and asset criticality, shipped the way a service would be: hardened container, Helm chart with network policy and restricted pod security, Terraform checked against LocalStack, and a GitHub Actions pipeline with SAST, dependency, secret, IaC and image scans, a kind-cluster deploy test and a ZAP baseline. The release image is signed with cosign.

kev-risk-prioritization: the prioritization idea from my internship as a small standard-library Python tool on synthetic data. KEV matches come first, then EPSS, CVSS and asset criticality, in the spirit of CISA BOD 26-04.

Also public

  • call-kettle: a phone-receptionist backend (FastAPI, Twilio) where booking rules are enforced in code, not by the model.
  • agent-engineering-lab: notes on working with AI coding agents and checking their output.
  • focuslog: a small Pomodoro timer.

Popular repositories Loading

  1. samiali38183 samiali38183 Public

    Profile README: Sami Ali, cybersecurity student at George Mason University building detection engineering, AppSec and vulnerability-management tools.

    1

  2. kev-risk-prioritization kev-risk-prioritization Public

    KEV-first vulnerability prioritization (CISA KEV, EPSS, CVSS, asset criticality) as a small stdlib Python tool; synthetic data

    Python 1

  3. tripline tripline Public

    CI quality gate for detections: emulate ATT&CK techniques, replay telemetry through Sigma rules, score prevalence-weighted coverage, fail PRs on regressions

    Python 1

  4. focuslog focuslog Public

    Focus session tracker with Pomodoro timer, session logging, and weekly dashboard

    HTML

  5. samiali38183.github.io samiali38183.github.io Public

    Sami Ali's portfolio

    HTML

  6. call-kettle call-kettle Public

    Phone receptionist backend (FastAPI, Twilio, Claude tool use): booking rules enforced in code, tenant isolation, cost limits. Sanitized public snapshot.

    Python