9 screensSAQR
Every camera has to keep earning trust. Across 2,400 simulated runs, SAQR caught every modelled attack with zero false alerts.
2,400simulated runs100%detection
Read the case study →saqrdefense.com↗
01Defensive cybersecurity · software engineering
I build secure systems
and prove it with numbers.
I’m Omar Alghamdi, a Saudi student in defensive cybersecurity. I build software people use every day, and I test it until the numbers hold.
02Work
Work#
Fourteen systems across 2025 and 2026, eight of them for clients. Each card opens the full story, with the numbers behind it.
9 screens
10 screensTatabbu
A family-safety app where a child’s location stays private by rules proven with SQL probes. It passed Google Play review in 14 minutes.
14 minPlay review176countries in closed testing
Read the case study →No public link
9 screensHalqat Wasl
Used daily at a government school: a teacher’s note reaches the guardian only through the path the regulation defines.
22staff using it103students
Read the case study →No public link
7 screensAlwaei Alfikri
The platform of the school awareness team I lead — guarded by an agent that screens every message, run at zero hosting cost, and closed until the school’s official launch.
60 sguard heartbeat3Durable Objects
Read the case study →No public link
10 screensDhura
A learning platform built on the Ministry textbooks, with interactive lessons for grades 5–9, 42,661 practice questions live and an AI that stays in the lesson.
46complete first-term courses, grades 5–91,340interactive lessons from the Ministry textbooks
Read the case study →dhura.app↗
7 screensPediaQuick
A pediatric reference in Arabic and English, built with a practising pediatrician: 143 clinical tools, every dose traced to its source and checked by a test.
143clinical tools: calculators, scores, scales and growth charts1,700+automated tests on the clinical core
Read the case study →pediaquick.app↗
ProFleet
Carrier companies with their own drivers, sending offers to shippers — built into the client’s live app on the App Store and Google Play.
Short case →No public link
Smart Pen
The credits, payments, real-time voice and story studio behind a client’s AI app, live on the App Store, Google Play and the web.
Short case →No public link
5 screensBeezato
Delivered on Android, iOS and the web with 476 automated tests, and checks that match every build to the contract.
476automated tests on one delivery3platforms: Android, iOS, web
Short case →Google Play↗
AgriDustria
Each of the client’s 162 messages traced to a verdict with evidence, and the database hardened with a rollback for every change.
162client messages traced to a verdict with evidence
Short case →No public link
7 screensAl-Warraq
A teacher picks the lessons and gets a print-ready exam on the school’s letterhead in about two minutes.
~2 minfrom lessons to a print-ready paper3paper types, each with its own typesetting
Short case →al-waraq.com↗
6 screensInteractive 3D Property Map
Every unit boundary measured from the CAD plan to within 0.05% — not traced by eye over satellite images.
0.05%calibration error on both surveyed plot edges0.0–1.2%measured footprints vs declared areas
Short case →map.zwaya-madinaty.com↗
Dhaleel
A walking router that computes real shadows — up to about 68% less direct sun on the same walk. An AI Showcase Featured Project.
~68%less direct sun on the same journey, at best0servers — fully static
Short case →No public link
SeeScript
Teaches programming in Arabic: a Python curriculum of 9 units, 32 lessons, 179 auto-graded exercises and 4 projects. In development, not yet open.
Short case →No public link
03Proof
How the numbers were measured#
Every figure here comes from a logged run or a dated record, never an estimate. This is the method behind each one.
Five attack scenarios and one benign baseline, 100 runs each, against four systems — 2,400 runs in a digital twin.
Same attacks, same 2,400-run sweep, four systems. SAQR caught every modelled attack; each baseline missed some.
SAQR
each baseline
of evidence kept its integrity guarantee end to end
| Evidence integrity | % |
|---|---|
| SAQR | 98 |
| each baseline | 75 |
| False alerts per hour | an hour |
|---|---|
| Vision-only | 2.9 |
| Network IDS only | 3.8 |
| SAQR | 0 |
98% evidence integrity, against 75% for each of the three baselines. Zero false alerts, where the vision-only and network-only systems raised 2.9 and 3.8 an hour. Every number here comes from a run that was executed and logged, not from an estimate; the engine, the raw results and the security assessment are part of the project record.
Every number here, with the method that produced it. Open a card to read how it was measured.
2,400
simulated runs in a digital twin
Every run executed by the simulation engine and written to a results file; the summary is computed from that file, not typed by hand.
In the project: SAQR
14 min
Google Play review time
Submission timestamp 10:22, release timestamp 10:36, both recorded in the Play Console release history.
In the project: Tatabbu
476
automated tests on one delivery
Counted by the test runner on the delivered source, alongside guard scripts that check each contractual clause against the built artifact.
In the project: Beezato
0.05%
CAD calibration error
Station geometry calibrated against both surveyed plot edges — 191.80 m and 162.20 m — and stored in metres in the plan’s own coordinate space.
In the project: Interactive 3D Property Map
19/19
DAST checks passed
Dynamic application security testing run against the live core, with bandit and pip-audit reporting zero findings.
In the project: SAQR
176
countries in closed testing
Country list selected in the Play Console release; 176 countries plus the rest-of-world option.
In the project: Tatabbu
42,661
practice questions live across the platform
The sum of every course’s question count in the live platform’s own content index, read on 30 October 2026 — what the platform serves, not the authoring files.
In the project: Dhura
30/30
planted policy faults caught
Each of 30 deliberate faults was planted in the row-level security policies on a temporary database, and the permission tests had to fail on every one; on the real policies all 137 pass.
In the project: PediaQuickI could tell you this site is hardened. Instead, press the button: your own browser fetches this page’s security headers right now and grades them. Nothing on this panel is pre-computed.
0/0
Independent check, not mine: Mozilla Observatory graded this site A+ — score 130, 12 of 12 tests passed (25 September 2026). Grades can change, so don’t take that date’s word for it either — re-run it yourself.
04Labs
Try it#
Small working versions of the ideas behind the projects, running in your browser — illustrations of the published mechanism, not the engines themselves.
· SAQR
When a camera stops earning trust
Pick a camera and inject a freeze, a replay or a cut. Watch its trust fall, its state change and its evidence drop out of the decision.
So the requirement became stricter: a camera that loses trust must stop being able to influence decisions at all. Not flagged — excluded. That single change moves the system from detection to containment, and it is much harder to build.
Illustration of the published mechanism, not the engine: the curve, the thresholds and the timings here are illustrative. Read the case study
· Tatabbu
Who can read this row?
Choose a role, run a query, see what the database returns and what it refuses. Then weaken a policy and let the probes catch it.
Inspection is not evidence. I wrote 25 SQL-level privilege probes that attempt, as each role, exactly the reads and writes that must fail — and assert that they do.
Then I attacked my own policies: 34 mutations deliberately weakened the security rules one at a time, and the probe suite had to catch every one. A policy layer that survives mutation is a policy layer that is actually load-bearing.
Illustrative schema, not the app’s: the tables, policies and rows here are invented for this page. Read the case study
· Halqat Wasl
A note that cannot skip the principal
Walk a teacher’s note through the roles. Then try to send it straight to the guardian and read the refusal.
Approval is structural. No message reaches a guardian before the principal approves it. This is a code path, not an administrative agreement — there is no button that skips it, because there is no route that skips it.
Four roles, genuinely separated. Teacher, student-affairs deputy, counsellor, principal. Each sees only what their role owns. The three school stages are isolated: primary staff cannot see intermediate or secondary data.
Illustration of the published approval rule; roles and rule from the case study, sample data invented. Read the case study
· Dhaleel
Try it: the shade-aware route
The idea behind Dhaleel, in your browser. Shaded cells are cooler; the router can take the short way or the cool way.
It computes real building shadows from OpenStreetMap geometry and the sun’s position, then finds the coolest route with Dijkstra’s algorithm, running in the browser on MapLibre.
Illustrative grid — the real router uses OpenStreetMap buildings and the sun’s position. Read the case study
Terminal
An interactive terminal, simulated in your browser. Type a command, or press a chip below.
Or press / anywhere on the page.
05Recognition
Recognition#
Competition results, programmes and certificates — each one opens the document behind it — and the path that led here.
Honors#
01
SAIF 2026 FinalistSAQR · final, in-person stage · Riyadh, 24–26 Nov 202602
NSMO 2026 National FinalistInformatics · Mawhiba · after three qualifying stages · NSMO 2027: 100 / 100 at stage oneCertificateSame programme
Participant in a Guinness World Records–setting AI lessonOne of 14,075 attendees · record achieved by Kanz with HRSD · 15 Jul 2026Does not prove An individual title; the record belongs to the organisers.
CertificateCertificates#
Click any certificate to enlarge, or download it.
Competition4 stages2026
NSMO 2026 Informatics — through to the national finals
Mawhiba · Informatics
Proves Three qualifying stages passed — Cities & Governorates, Education Departments, National Teams — and a place in the National Finals of NSMO 2026, the National Science and Mathematics Olympiad run by Mawhiba with the Ministry of Education, Informatics track.
01
NSMO 2026 — Cities & Governorates
02
NSMO 2026 — Education Departments
03
NSMO 2026 — National Teams
04
NSMO 2026 — National Finals
Course2026
Harvard CS50P — Programming with Python
Proves Completing Harvard’s CS50P: nine problem sets and a final project (2026).
CS50P — Programming with PythonHarvard University · 2026
Assessment2024
Mawhiba Cognitive Abilities — 1,617 / 2,000
Proves A score of 1,617 out of 2,000 on the Mawhiba Cognitive Abilities Test (2024).
Cognitive Abilities — 1,617 / 2,000Mawhiba · 2024
Programme2026
AI Training Hackathon
AI Training Hackathon — Dhaleel featured
Kanz with LAU ACE · Jul 2026
Proves Completing the Kanz AI Training Hackathon (with LAU ACE, July 2026) and building Dhaleel, selected as an AI Showcase Featured Project — certificate ID KANZ-ADV-2183.
Case study: DhaleelSame programme
Guinness World Records event — participation
Participant in a Guinness World Records–setting AI lesson
One of 14,075 attendees · record achieved by Kanz with HRSD · 15 Jul 2026
Proves Attendance at the record-setting lesson.
Does not prove An individual title; the record belongs to the organisers.
Case study: DhaleelCourse2024
Cybersecurity — Doroob
Proves Completing the Cybersecurity course on Doroob (Human Resources Development Fund, 2024).
Two fields are redacted — why
On the Doroob certificate two fields are covered with opaque boxes marked “Redacted”: the national identity number (in both languages) and the verification code at the foot of the page, because that code can be used to retrieve the number. Nothing else is altered, and the unredacted original is available on request.
CybersecurityDoroob · Human Resources Development Fund · 2024
Assessment2 tests
HackerRank — Python and Problem Solving (Basic)
HackerRank
Proves HackerRank’s basic-level certification tests, passed in Python and in problem solving.
Python (Basic)
Problem Solving (Basic)
Course4 levels2026
C++ track, 101–104 — Satr
Proves Completing the C++ course sequence on the Satr platform, from 101 to 104 (104 in Jun 2026).
01
C++ 101Satr platform
02
C++ 102Satr platform
03
C++ 103Satr platform
04
C++ 104Satr platform · Jun 2026
Course3 levels
Python track, 101–103 — Satr
Satr platform
Proves Completing the Python course sequence on the Satr platform, from 101 to 103.
01
Python 101
02
Python 102
03
Python 103
Programme2026
School appreciation — intellectual security programme
Proves A certificate of appreciation from Al-Rayyan Intermediate School (Taif) for outstanding effort in the school’s intellectual security programme and initiative — the Alwaei Alfikri team and platform (2026).
Case study: Alwaei AlfikriAppreciation — intellectual security programmeAl-Rayyan Intermediate School · 2026
The path#
Every step aimed at one destination.
Mawhiba cognitive abilities test
Scored 1,617 out of 2,000 and entered the national gifted track.
Moderneex Studio founded
37 governance and policy documents, a brand identity, a 142-icon design system.
Fourteen systems built
Mobile apps on the App Store and Google Play, school platforms, a learning platform, a pediatric clinical reference, a 3D property map, a navigation agent and a cyber-physical defense system.
NSMO Informatics — through to the national finals
Cities & Governorates, Education Departments, National Teams, then the finals.
Kanz AI Hackathon — Dhaleel featured
An original AI project selected for the AI Showcase.
Participant in a Guinness World Records–setting AI lesson
One of 14,075 attendees · record achieved by Kanz with HRSD · 15 Jul 2026
Harvard CS50P completed
Nine problem sets and a final project, certificate issued.
Dhura goes live under Moderneex
A learning platform for grades 5–9: 46 first-term courses complete, with 1,340 lessons from the Ministry textbooks.
SAIF 2026 — SAQR through to the final stage
Final acceptance to the in-person exhibition in Riyadh, 24–26 November 2026.
NSMO 2027 — 100 / 100 at stage one
Informatics, in the Education Department competition test on 22 October.
Nabih — a play-to-learn game design, submitted
An AI-literacy game in which the player trains a robotic falcon with data, not code: a six-page game design document for the Ministry of Education’s play-to-learn competition (2026–2027), written with a classmate and now awaiting judging.
Governor, National Cybersecurity Authority
The destination. Everything above is preparation.
06About
About#
Who I am, how I work, and where I’m headed.
I’m Omar Hassan Alghamdi, a Saudi student who builds software real people use: apps on the App Store and Google Play, platforms that schools run every day, a pediatric clinical reference made with a practising pediatrician, and an interactive property map. I also built SAQR, a cyber-physical defense system for critical facilities — now a finalist at SAIF 2026 in Riyadh.
My field is defensive cybersecurity, and I treat it as a way of building rather than a title: access enforced in the data itself, claims proven by measurement, and checks run on the version that actually shipped.
My long-term goal is to lead Saudi Arabia’s national cyber defense as Governor of the National Cybersecurity Authority. Everything here is a step toward it.
- Prove, don’t assumeIf it hasn’t been measured, it isn’t known yet.
- Test what shippedChecks run on the version users actually get, not only on the source.
- Enforce access in the dataA screen can look right and still let the wrong person in.
- Fail safe, and say soWhen something goes wrong, the system stops trusting it and raises the alarm.
- Built to run for freeEverything I host myself runs at zero cost.
Skills#
No self-ratings: each skill links to the project or certificate where I used it.
| Skill | Proven in | Certified by |
|---|---|---|
| Security | ||
| Defensive Security | SAQRAlwaei Alfikri | — |
| Application Security | SAQRTatabbuHalqat WaslAlwaei AlfikriInteractive 3D Property MapSmart PenDhuraPediaQuick | — |
| Network Security | SAQRAlwaei Alfikri | — |
| Threat Modeling | SAQR | — |
| Languages | ||
| Python | SAQRDhaleelSeeScript | CS50P — Programming with PythonPython 101Python 102Python 103Python (Basic) |
| C++ | — | C++ 101C++ 102C++ 103C++ 104 |
| JavaScript | Halqat WaslDhuraPediaQuick | — |
| Mobile | ||
| Flutter / Dart | BeezatoProFleet | — |
| React Native | TatabbuSmart PenAgriDustria | — |
| Infrastructure | ||
| Cloudflare Workers | Halqat WaslAlwaei AlfikriDhura | — |
| FastAPI | SAQR | — |
| PostgreSQL / RLS | TatabbuPediaQuickSmart PenAgriDustria | — |
| Release Engineering | TatabbuBeezatoProFleetSmart PenAgriDustria | — |
| Governance | ||
| PDPL / Compliance | Halqat WaslTatabbuDhura | — |
07Contact
Contact#
For judges, mentors and security teams — WhatsApp and email reach me directly, and I reply myself. Open to mentorship and cybersecurity programmes.
Two CV formats on purpose. The designed sheet is for a human reader — English on the front, the same CV in Arabic on the back. The portal versions are single-column with standard headings, so an applicant tracking system reads them in the right order; PDF, DOCX and TXT hold the same text.