Skip to content
Luvveer

I build backend systems, then try to break them before someone else does.

Computing Science student. Audit-first APIs, protocols that don't trust input, and the testing infrastructure that proves it actually holds.

View Projects Resume
tcp://127.0.0.1:9000 · fuzz_monitorsim
waiting for first frame…
frames 0rejected 0crashes 000:42:11

simulated, same framing protocol as the TCP fuzzer below

Backend systems built to survive hostile input.

Solo security tooling and team projects where I owned backend, infrastructure, or reliability: protocols, auth, and audit trails that assume something will eventually try to break them. Every entry links to a full case study.

resqplate.tsprivate
Team projectJun - Jul 2026

ResQPlate: Surplus Food Redistribution Platform

A capstone-scale team project: businesses list surplus food, verified through an approval workflow, and it's discovered by nearby seekers through geo-aware search. I owned the backend auth system, the GCP deployment pipeline, secrets management, and search indexing.

  • Built the deploy pipeline: GitHub Actions workflows SSH/SCP a build to a GCP Compute VM, pull secrets (DB URL, auth secret, API keys) from GCP Secret Manager at deploy time rather than baking them into the image, and run the service under PM2.
  • Made the deploy self-verifying: it polls the health endpoint with backoff before declaring success, and dumps recent process logs on failure instead of failing silently.
  • Owned authentication end-to-end (signup/login/session middleware) and debugged a cross-origin cookie issue through a Cloudflare Workers proxy in front of the API, tracing it down to how the proxy handled credentialed requests.
  • Designed the search/discovery path: Algolia indexing sequenced deliberately after each deploy's health check passes, so search results never point at a backend that isn't actually up yet.
TypeScriptExpressDrizzle ORMPostgreSQLDockerGCPGitHub ActionsAlgolia
Read the case study

restaurant listing verification workflow

perturbation-flakiness-testing.pypublic
Team projectFeb - Apr 2026

PyFlake: Flaky Test Detection via Perturbation

Most flaky-test tools just re-run a suite and hope. PyFlake instead perturbs specific sources of nondeterminism (RNG seeds, async timing, execution order, wall-clock drift) and uses a two-stage statistical test to distinguish genuine flakiness from environment noise.

  • Implemented perturbation operators (random-seed, async-delay, execution-order, time-drift) that monkey-patch nondeterminism sources at the right layer, including eagerly seeding the global RNG at setup time to catch module-level randomness that a naive per-test seed would miss.
  • Designed a two-gate statistical evaluator: a one-sided Fisher's exact test on operator-vs-baseline pass/fail counts to confirm a perturbation actually changed outcomes, followed by a Wald-Wolfowitz runs test on the outcome sequence to separate genuine non-determinism from clustered environmental noise.
  • Set up the initial monorepo, Poetry dependency management, pre-commit hooks, mypy type checking, and the lint/test/typecheck GitHub Actions pipeline the team shipped through for the rest of the project.
PythonpytestSciPyDockerPoetryGitHub Actionsmypy
Read the case study Source

8 re-runs of the same suite, unperturbed

ai-security-operations-platform.pypublic
Solo projectDec 2025 - Feb 2026

AI Security Operations Platform

Ingests security events, extracts behavioral features in time windows, produces a weighted, explainable risk score per entity, and routes anything suspicious through a deterministic triage policy with a full audit trail. Never a black-box auto-response.

  • Built a capped, weighted risk scorer over multiple behavioral signals (failed-login bursts, fail/success ratio, events-per-minute spikes, permission-denied counts, distinct users targeted) that returns a 0-100 score alongside the specific reasons behind it, not just a number.
  • Modeled the schema audit-first: every event, alert, agent run, and response action is a persisted, foreign-keyed record, so any decision the system made can be reconstructed after the fact.
  • Kept triage logic deterministic and rule-based on purpose rather than reaching for an opaque model. Every branch of the policy carries a rationale string, and responses are recorded as recommendations for a human to approve, never auto-enforced.
PythonFastAPIPostgreSQLSQLAlchemyPydantic
Read the case study Source

the audit-trail schema, event to approval

fraud-detection-hackathon.pylocal-only
Team projectFeb 2026

Fraud Detection: ML Hackathon

Built with teammates under hackathon time pressure: a LightGBM classifier over a heavily imbalanced transaction dataset, with feature engineering aimed at making rare fraud patterns visible rather than chasing overall accuracy alone.

  • Iterated across multiple LightGBM configurations and feature sets on a heavily imbalanced multi-class dataset, rather than stopping at the first model that scored well on aggregate accuracy.
  • Engineered domain-specific features in Pandas (transaction velocity, merchant risk scoring, and time-of-day patterns) to surface fraud signals that generic off-the-shelf features missed.
  • Optimized specifically for precision on the minority fraud classes, since raw accuracy on an imbalanced dataset can look excellent while still missing most of the fraud that matters.
PythonLightGBMPandas
Read the case study

engineered features feeding the classifier

tcp-group-chat-fuzzer.cpublic
Solo projectOct - Dec 2025

TCP Group Chat + Protocol Fuzzer

A thread-per-connection TCP server implementing a custom binary framing protocol over raw sockets, built alongside a fuzzing client that generates unpredictable payloads from real entropy to probe how the server handles malformed input.

  • Implemented correct TCP stream reassembly: a growable buffer reconstructs message boundaries from an arbitrary sequence of partial reads, rather than assuming one read() call maps to one message. That's the detail that separates working network code from code that only works in a demo.
  • Ran one detached pthread per connected client, with a broadcast mutex protecting the shared client list separated from a second mutex coordinating a synchronized multi-client shutdown handshake.
  • Built the fuzz client to source payload entropy from getentropy() rather than a seeded PRNG, so fuzzing runs aren't accidentally reproducible in a way that hides real bugs.
CPOSIX socketspthreads
Read the case study Source

reassembling a message from partial TCP reads

posix-mini-shell.cpublic
Solo projectOct - Dec 2025

POSIX Mini Shell

An interactive shell implementing process spawning, foreground/background execution with zombie reaping, signal handling that survives Ctrl-C, and command history, validated by a GoogleTest suite covering adversarial and interactive cases, not just happy paths.

  • Implemented fork/execvp/waitpid process control with error-path handling on every syscall, plus background execution (&) with non-blocking zombie reaping so finished background jobs don't accumulate.
  • Trapped SIGINT so Ctrl-C interrupts a running foreground command without killing the shell itself or leaving the terminal in a broken state.
  • Wrote a 1,190-line, 32-case GoogleTest suite, roughly 3x the size of the shell's own implementation, covering background execution, history recall (!!, !n), invalid history indices, and Ctrl-C during execution.
CC++GoogleTestPOSIX
Read the case study Source

process lifecycle: fork, exec, wait, reap

A little about how I think about engineering.

I'm a Computing Science student at Simon Fraser University, minoring in Mathematics, based in British Columbia, focused on backend engineering and cybersecurity.

I like software that has to survive conditions nobody planned for: a malformed packet, a credential-stuffing burst, a test that only fails on Tuesdays. Most of the projects on this site exist because I wanted to understand a specific way systems break (or get broken into) well enough to build something that actually holds up against it.

That's what pulls me toward backend systems and security work specifically: audit trails that survive scrutiny, protocols that don't trust their input, deploy pipelines that fail loudly instead of silently. I'd rather spend a weekend fuzzing my own server than assume it's fine.

Based in
British Columbia, Canada
Studying
B.Sc. Computing Science, SFU
Minor
Mathematics
Focus
Backend, systems, security, reliability

Leadership & mentorship alongside the engineering.

  1. International Exchange Consultant

    Jan 2025 - Present

    AIESEC in SFU, Burnaby, Canada

    • Advise exchange participants on visa processes, travel, and accommodation logistics for international placements.
    • Guide participants through securing and preparing for exchange opportunities, coordinating a smooth transition into an unfamiliar country and culture.
    • Maintain ongoing communication with global partner offices to keep collaboration and program quality consistent across countries.

  2. Peer Educator

    Jan 2022 - Sep 2023

    Fraser International College, Burnaby, Canada

    • Provided academic support to fellow students in C++, Python, and mathematics coursework, alongside study strategy guidance.
    • Mentored incoming students through the transition to university life, including navigating academic expectations and campus resources.

Tools I reach for, organized by what they're for.

#AREATOOLING
01LanguagesC · C++ · Python · TypeScript · Java · Rust · SQL · Bash
02Backend & DataFastAPI · Express · PostgreSQL · SQLAlchemy · Drizzle ORM · Node.js
03Systems & InfrastructurePOSIX · pthreads · Linux · Docker · AWS · GCP · Kubernetes · GitHub Actions
04AI / ML & TestingLightGBM · scikit-learn · Pandas · NumPy · pytest · GoogleTest · SciPy
05FrontendReact · Next.js · TypeScript · Tailwind CSS

Open to backend and cybersecurity internships.

The fastest way to reach me is email, happy to walk through any of the projects above in more detail.

Emaillsl11@sfu.caGitHubgithub.com/LuvveerLinkedInLuvveer Singh LambaResumeDownload PDF