Ayaan Siddiqui

Keyboard-driven set reporting for Super Smash Bros. tournament organizers, built against the start.gg API and live at smashset.gg. I run tournaments myself; reporting a set through start.gg's own interface takes 15–20 seconds of clicking, and at a local with a hundred sets that's most of an hour spent looking at a laptop instead of at the room. SmashSet does it in 5–10 seconds, entirely from the keyboard.

• An OAuth 2.0 flow written directly rather than through a library — authorization-code exchange, concurrent-safe token refresh, AES-256-GCM encryption of tokens at rest. The client secret stays out of the authorize URL that start.gg's own published example puts it in, because that URL is a front-channel browser redirect and lands in history, referrers and logs. server/src/startggOAuth.ts · scoped to user.identity + tournament.reporter, nothing wider
• A production outage, and the fix that wasn't a smaller number. The bracket stopped loading because a query-cost constant had been measured once and then hardcoded; adding fields to the query silently pushed a page past the API's object cap. Pagination now derives page size from a declared cost-per-row, reads the cost the API reports back on every response, and resizes itself when a request is rejected. A scheduled contract test re-measures against the live API daily and fails when reality drifts. server/src/routes/sets.ts — fetchSetsPaged · .github/workflows/startgg-canary.yml
• Reports queue to an outbox and deliver behind the organizer. Venue wifi produced a measured 25-second freeze against a socket that accepts a connection and never answers. Delivery now retries with capped exponential backoff and jitter. Deliberately not optimistic: nothing reads as reported until the API confirms it, because an organizer who sees a tick and walks away leaves a set unreported. Retries are made safe by a stricter server-side rule rather than an idempotency key — the upstream refuses to re-report a finished set, so the ambiguous timeout resolves without inventing one. web/src/outbox.ts · up to 25 s of frozen UI, measured on venue wifi

TypeScript · React · Express · PostgreSQL · GraphQL · OAuth 2.0 · Railway · GitHub Actions

An early-stage startup building an electronic health record for clinics in Bangladesh, where no widespread EHR exists. I took it from a Figma file to beta builds on TestFlight and the Play Store, and I'm the only engineer on it. A monorepo spanning a React web app, an Expo mobile client and a FastAPI backend, with the shared business logic in one TypeScript package so the two clients can't drift apart.

• A clinical drug-safety engine that blocks a prescription before it can be sent — allergy contraindications and high-severity interactions, hard-blocked at the point of prescription rather than warned about afterwards. formulary and interaction data sourced from MedEx and DDInter
• The de-identification layer over everything an administrator can see. k-anonymity small-cell suppression at k=11, the HHS/CMS convention, plus complementary suppression and age/region generalization on every analytics export. Paired with a chart authorization model where privilege narrows as it rises: a doctor needs an active care-panel relationship rather than the doctor role alone, and administrators are denied individual patient charts entirely while keeping aggregate analytics. app/core/deident.py · app/core/access.py — admins see populations, never people
• Diagnosed platform-wide latency to two distinct bottlenecks and fixed both. Per-keystroke sequential scans over the formulary became PostgreSQL trigram GIN indexes, after a leading-wildcard ILIKE turned out to defeat the B-tree index that was already there; redundant full-table reloads became a thread-safe TTL cache. pg_trgm + gin_trgm_ops · 17 Alembic migrations, 16 pytest modules, run in CI against a Postgres service container on every push

Python · FastAPI · TypeScript · React · React Native (Expo) · PostgreSQL · SQLAlchemy · Docker · Railway

A searchable atlas of facial plastic surgery reconstruction cases, for surgical education inside UVA Health. I'm the sole technical member of the research team. The most useful thing I did on it involved no code at all.

• I read the governing IRB protocol and the patient consent forms before development started, and found a HIPAA blocker nobody had caught — the team's plan to share patient photographs with surgeons outside UVA wasn't supported by the consent patients had actually given. I spent four months as the sole technical liaison across UVA Research Computing, Health IT and the department chair, and proposed the internal-only pivot that unblocked hosting approval. IRB protocol 18181 · scope reframed before a line of the application was written
• Patient media is served through a single server-side chokepoint, never a direct file URL. Three independent path-traversal checks, an extension allowlist, and PBKDF2-SHA256 session authentication extended to every data endpoint. That one-door design is what makes per-user authorization and access logging a single instrumentation layer instead of a re-architecture. 21 endpoints · 143 de-identified cases · 16-page security review authored for the hosting evaluation

Python · FastAPI · SQLite · JavaScript · institutional review, security documentation

A benchmark measuring how retrieval-augmented generation performs on questions that need several documents to answer. I owned the measurement and persistence layer — the LLM-as-judge scoring, the SQLite schema, and the dashboard the team read results in. The interesting part is what the data showed.

• The pipeline failed in different ways depending on the reasoning the question required, and the two halves failed on opposite categories. Inference queries were hardest to retrieve for — recall 0.31 against 0.46 on comparison queries — but when the model did answer them it stayed grounded, at 0.85 faithfulness. Temporal queries were the reverse and the more worrying case: retrieval was fine, and faithfulness collapsed to 0.30. Those are two different fixes, and neither is visible in the aggregate. 2,255 scored responses · segmented by query type, because the overall faithfulness number of 0.55 says nothing

Python · DeepEval · LangChain · ChromaDB · SQLite · Streamlit