Hi, I'm Tarek 👋

Founder & Lead Architect @ Veraptos — building the universal rule compiler for AppSec ("Terraform for Threat Detection"). Write abstract vulnerability logic once (CPG/AST) $\rightarrow$ compile & lower directly into native CodeQL | Semgrep | Opengrep | Nuclei | YARA | Sigma | Hexens Glider rules across Web2 & Web3.

 ┌────────────────────────────────────────────────────────┐
 │                Abstract Threat Invariant               │
 │       (Write once: Natural Language, YAML, or Code)    │
 └───────────────────────────┬────────────────────────────┘
                             │
                             │ (1) AI translation
                             ▼
 ┌────────────────────────────────────────────────────────┐
 │                    Agentic AI Layer                    │
 │               Translation & Graph Mapping              │
 └───────────────────────────┬────────────────────────────┘
                             │
                             │ (2) Standardized Logic
                             ▼
 ┌────────────────────────────────────────────────────────┐
 │         Veraptos Lowering Engine (CPG / AST)           │
 │            (Closed Core / Proprietary IR)              │
 │                                                        │
 │   • High-Fidelity Graph Traversals                     │
 │   • Feature Extraction & AST Mapping                   │
 │   • Deterministic Rule Compilation & Optimizers        │
 └───────────────────────────┬────────────────────────────┘
                             │
     ┌───────┬───────┬───────┼───────┬───────┬───────┬───────┬───────┐
     │       │       │       │       │       │       │       │       │
     ▼       ▼       ▼       ▼       ▼       ▼       ▼       ▼       ▼
 ┌───────┐┌───────┐┌───────┐┌───────┐┌───────┐┌───────┐┌───────┐┌───────┐┌───────┐
 │CodeQL ││Semgrep││Opengp ││ Joern ││Nuclei ││Glider ││Slither││ YARA  ││ Sigma │
 └───────┘└───────┘└───────┘└───────┘└───────┘└───────┘└───────┘└───────┘└───────┘

Architecture Note: The pipeline cleanly separates intent from enforcement. LLM components are restricted to front-end invariant drafting from natural language or specifications. The closed-core Veraptos engine then takes over: validating candidate logic against Code Property Graph (CPG) semantics, checking reachability, and deterministically compiling the invariant into syntax-checked, native queries with zero manual refactoring. Built in native Rust

• Veraptos Threat Library ⚡

  • What it is: 10 deterministic AppSec rules (Slither plugins + Opengrep YAMLs) deterministically lowered from abstract threat invariants.
  • Validation: 11/11 PASS on a strict True Positive / True Negative regression harness against pinned Damn Vulnerable DeFi (v3.0.0) fixtures and safe negative controls.
  • Impact: Demonstrates how multi-condition invariant logic outperforms heuristic linters by eliminating false positives. (MIT Licensed).

• VeraptosBench-mini 📊

  • What it is: A reproducible evaluation benchmark for static analysis tools and AI models.
  • Metrics: Measures Fix Discrimination (pre-patch recall vs. post-patch silence) rather than just raw bug finding.
  • Results: Proves mathematically how standard heuristic engines (like stock Slither and Opengrep) fail to distinguish between vulnerable code and resolved oracle patches on real-world Web2 (Python) and Web3 (Solidity) advisories.

Contributions to upstream engines made while developing, stress-testing, and improving intermediate representation lowering:

• Joern Dataflow Core (joernio/joern): #6358 - Core REACHING_DEF path drop fixes for nested structs & pointer derefs [Merged Oct 4, 2026]

• Joern CPG Engine (joernio/joern): #6298 - C2CPG double-pointer dataflow reachability fixes [Merged Sep 24, 2026]

• Joern CPG Linker (joernio/joern): #6355 - Link dynamic pointer calls to method refs in conditional receivers [Merged Oct 9, 2026]

• Joern Ruby CPG (joernio/joern): #6440 - rubysrc2cpg: emit STATIC modifier for singleton methods [Merged Oct 21, 2026]

• Opengrep CLI (opengrep/opengrep): #844 - fix(cli): make --test work on Windows [Merged Oct 20, 2026]

• • Joern Dataflow Engine ( joernio/joern ): #6472 - Preserve reaching definitions for conditional operator conditions [Merged Nov 1, 2026]

• Joern Dataflow Semantics ( joernio/joern ): #6473 - Normalize binary operator DDG semantics to eliminate spurious cross-operand edges [Merged Nov 1, 2026]

Native rules and query artifacts compiled from abstract threat invariants down to target scanner syntaxes:

• Sigma ( SigmaHQ/sigma ): #6353 - LDAP Nightmare dual detection & native WER crash telemetry (CVE-2024-49113) [Merged Nov 3, 2026]

• CodeQL (github/codeql): #22438 - C++ MMIO un-sanitized memcpy query [Merged Sep 21, 2026]

• Semgrep (semgrep/semgrep-rules): #4052 - TypeScript MCP command injection & SSRF [Merged Sep 21, 2026]

• Nuclei (projectdiscovery/nuclei-templates): #17286 - Harden CVE-2025-29927 against middleware-bypass false positives [Merged Oct 13, 2026]

• Nuclei (projectdiscovery/nuclei-templates): #17007 - changedetection.io LFI non-destructive refactor & cleanup (CVE-2024-51483) [Merged Oct 8, 2026]

• Nuclei (projectdiscovery/nuclei-templates): #17171 - Ray RCE (CVE-2025-62593) [Merged Sep 24, 2026]

Author of 7 automated Solidity AST invariant detection queries on Glider IDE:

• [+] Decimal Precision Loss via Scale-to-Single/Dual-Vault [Pending merge - Aug 30, 2026]

• [+] Native Asset Double-Spend via settle/sweep logic [Pending update - Aug 6, 2026]

• [+] Duplicate Signature Quota Bypass via reuse [Pending update - Aug 5, 2026]

• [+] Risc0 ZK Unbound Journal Digest [Pending update - Aug 4, 2026]

• [+] Merkle Shift-Compose Overflow via verifier logic [Pending update - Aug 4, 2026]

• [+] Governance Check-Effects-Interactions (CEI) [Pending merge - Aug 3, 2026]

• [+] ABI Smuggling - Fixed-Offset Calldata [Pending merge - Jun 22, 2026]

• ⚡ cpg-nuclei-compiler : Deterministic Joern CPG-to-Nuclei YAML compiler & Docker verification harness. Available as a v1 GitHub Action for automated non-destructive template testing in CI.
• 📖 Medium Article: CPG Compilation vs. LLM AI Generation: Empirical Analysis of CVE-2025-62593 Rule Accuracy

• LinkedIn: in/tarek-mhiri
• X / Twitter: @TITO088
• Medium: @mhiritarek

Self-funding the Veraptos R&D floor one pizza 🍕 at a time while lowering CPG ASTs into multi-format threat rules.