# Mahshooq Zubair - Software Engineer & Security Researcher

> Professional portfolio of Mahshooq Zubair, a Senior Software Engineer at Applied Informatics Solutions Pvt. Ltd. (TrialX), focused on full-stack development, cybersecurity, cloud architecture, and AI-assisted tooling.

Current role: Senior Software Engineer at Applied Informatics Solutions Pvt. Ltd., remote, since April 2025. Work includes application performance, system design, developer tooling, application security testing, and an AI-assisted GitLab workflow that generates fixes for HTTP 500 errors and opens merge requests for review. Selected for the six-month Head of Initiatives program focused on performance, security practices, and infrastructure monitoring.

Previous experience: Software Engineer at CyberHeals from October 2023 to September 2024, then Senior Software Engineer from September 2024 to March 2025; Junior Software Engineer at Zennode Technologies from July 2022 to September 2023; Backend Developer at Infyplus Innovations from April to July 2022; AppSec & Software Tester at Root-Sys Technologies from August 2020 to July 2021.

Technical experience includes Python, JavaScript, TypeScript, Django, Flask, React, Next.js, PostgreSQL, MongoDB, Redis, Docker, AWS Lambda, CloudFormation, GitHub Actions, multi-tenant SaaS architecture, security automation, and AI integration. Projects include both employer-owned products and open-source work; use each project's own source and license for ownership and reuse terms.

## Portfolio

- [Portfolio overview](https://mahshooq.dev/): Engineering experience, projects, security research, and writing. Uses section snapping and a shadcn/ui ScrollArea.
- [Projects](https://mahshooq.dev/projects): Detailed project portfolio, contributions, dates, and technology stacks.
- [Professional experience](https://mahshooq.dev/experiences): Roles, employment dates, and engineering contributions.
- [Resume](https://mahshooq.dev/Mahshooq-Zubair-Resume.pdf): Downloadable resume.

## Selected projects

- [Connect](https://www.trialx.com/patient-recruitment-management-system): Enterprise patient recruitment management platform at TrialX.
- [Truzta](https://truzta.com/): AI-driven compliance automation and security platform at CyberHeals.
- [R3C0Nizer-v2](https://github.com/initcrew/R3C0Nizer-v2): Open-source workflow orchestration tool for pentesters and bug hunters.
- [DocHours](https://dochours.com): Multi-tenant clinic management platform at Zennode Technologies.
- [CloudGram](https://cloudgram.vercel.app/): Cloud storage built on Telegram.

## Security research and writing

- [CVE-2024-12880 - RAGFlow](https://huntr.com/bounties/c41c7eaa-554a-408c-96be-9dba56113970): Reported a partial account takeover vulnerability caused by insecure data querying (March 2025).
- [CVE-2023-36809 - Kiwi TCMS](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-jpgw-2r9m-8qfw): Credited as a reporter for a stored cross-site scripting vulnerability (August 2023).
- [Multi-Tenancy in Flask](https://medium.com/@mahshooq/multi-tenancy-in-flask-f5a5960fc9e4): Schema-per-tenant SaaS architecture using Flask and PostgreSQL, including provisioning, authentication, migrations, and request-level schema switching (January 2024).

## Profiles and contact

- [GitHub](https://github.com/mq-xz/): Open-source projects and contributions.
- [LinkedIn](https://www.linkedin.com/in/mahshooq/): Professional profile.
- [Medium](https://medium.com/@mahshooq): Technical writing.
- [X](https://x.com/mq_xz_): Social profile.
- [Email](mailto:kmahshooq@gmail.com): Professional contact and security disclosure contact.

## Optional

- [RSS feed](https://mahshooq.dev/rss.xml): Security research, writing, and selected projects.
- [Sitemap](https://mahshooq.dev/sitemap.xml): Canonical pages on this website.