Project on Mazin Ahmed

Backlog: A Local-First Task and Context Manager for Humans and AI

Tue, 07 Jul 2026 11:28:35 +0000

I’ve been working with agentic AI for the past two years, and I kept hitting the same wall: managing the tasks and to-dos it generates. Moving what it learns between sessions. Improving a product without keeping one session open for days.

Keeping a session open for days builds up context, and I get billed for all of it on every request to Claude. Caching helps, but it’s still expensive. The agent forgets what happened, especially the small details, and there’s no real way to hold onto it.

Preventing Prompt Injection Attacks at Scale

Mon, 09 Jun 2025 00:00:00 +0000

Prompt injection attacks are one of the most common LLM security threats we have all seen while reviewing LLM implementations, integrations, and AI-powered systems.

I have identified Prompt Injection attacks in numerous implementations and applications, and I’ve decided to write a blog post to recommend different methodologies I experimented with that can prevent prompt injection at scale.

I will also share a LangChain Prompt Injection attack vector, vulnerabilities in example MCP implementations, and practical ways to prevent prompt injection attacks.

Introducing LLMQuery Framework: Scaling GenAI Automation with Prompt Templates

Mon, 13 Jan 2025 00:00:00 +0000

Large Language Models have completely changed how we automate, create, and solve problems.

Integrating and experimenting with these models across different providers, along with optimizing LLM prompts and benchmarking them, can feel overwhelming. That’s why I built llmquery this year, to make interacting with Large Language Models and prototyping new GenAI-powered applications simpler and faster.

llmquery is all about making it easier to prototype new applications and use cases. It just starts with writing a single YAML template (or using one of the built-in YAML templates available) where the YAML template handles all the overhead of integrating with commercial and local providers, helping with validating models, calculating tokens, setting limits, rendering templates, and other checks.

Engineering Learnings from the CrowdStrike Falcon Outage

Fri, 26 Jul 2024 00:00:00 +0000

What Happened? #

On July 18, 2024, the world witnessed a global outage that disrupted major industries, including banking, airlines, healthcare, oil and gas, and governments. The outage was caused by a faulty software update by CrowdStrike that left Windows computers in a continuous BSOD (Blue Screen of Death) loop.

(Banners of Time Square are showing Windows BSOD as a result of the CrowdStrike incident)

Secrets Patterns DB: Building Open-Source Regex Database for Secret Detection

Tue, 07 Feb 2023 00:00:00 +0000

Ensuring the security of your organization’s sensitive information is critical for any security team, and detecting secrets is a key part of that. However, even if you have implemented advanced security controls, your program may still be at risk if passwords and API keys are committed to GitHub and subsequently exposed in a production environment, whether through a live web application, a compiled mobile app, or minified JavaScript code. To mitigate this risk, secrets must be secured and managed properly throughout development.

tfquery: Run SQL queries on your Terraform infrastructure

Wed, 28 Apr 2021 00:00:00 +0000

Have you ever tried analyzing a Terraform environment with thousands of cloud resources for security and DevOps? It used to be hard, until now!

I’m open-sourcing my newest project, tfquery: a framework that allows running SQL queries on Terraform code. It saved me dozens of hours in analysis.

tfquery helps answer questions that are hard to answer about your infrastructure-as-code. It allows querying resources and analyzing their configuration using a SQL-powered framework.

DDoS is not Dead: Building a Scalable DDoS Framework

Tue, 13 Apr 2021 00:00:00 +0000

Abstract #

I’m releasing my latest project, Stressful.io, an advanced DDoS framework for testing DDoS defenses at scale. I also provide free simulations to non-profit organizations and startups focused on privacy and digital rights.

I have always been fascinated by DDoS attacks. You may have the most sophisticated defenses, yet your organization can be directly affected by a DDoS attack that takes down your payment gateway for 3 hours. DDoS attacks are a genuine concern that must be put on the organization’s radar, not on a postmortem after an attack.