Academics

Software engineering, UIT University.

I learned how software works. Then I built it. Now I study where it breaks.

What I studied

The ideas underneath everything I build.

Final-year project

Loadify

Performance testing on autopilot, built in a team of three. Hours of manual work now take minutes.

Loadify fills the app with 100K lines of real data and spins up 50+ Docker or EC2 instances. It records one Playwright test, then runs it on every instance at the same time.

Playwright, JMeter, Terraform, AWS, Docker

Built alongside my degree

In progress

Can AI coding agents find the authorization flaws they introduce?

A study on multi-tenant web apps, built from real flaws found and fixed in products I designed and built.

Muhammad Shahzad4

5References

Vero et al. BaxBench: can LLMs generate correct and secure backends? ICML 2025.
Zhao et al. Is vibe coding safe? Benchmarking agent-generated code in real-world tasks. ICML 2026.
Gupta and Sreenivasamurthy. Structured decomposition for reliable LLM-generated access control policies.
Zhou, Vatsa and Eiers. RAISE: access control policy synthesis via symbolic evaluation.
Supabase. RLS performance and best practices.
Espiritu and Cash. Plaintext recovery against post-filtering access control. USENIX Security 2026.

Authorization flaws in agent code3

3The benchmark

create policy tenant_read
  on invoices for select
  using (company_id =
    (select auth.company_id()));

Listing 1. A tenant isolation policy.

ownershiprolessharingJWT claimsstoragetimeviewssoft delete

Table 1. Access patterns the tasks cover.

Authorization flaws in agent code2

2Method

SpecAgentPolicyProbes

CorrectLeakLockout

Fig. 1. Every task runs through the same pipeline.

Preprint · Draft 1

Can AI coding agents find the authorization flaws they introduce?

Muhammad Shahzad

Abstract

Coding agents now write a large share of production web code. We reproduce five access-control flaws from two real multi-tenant systems and measure whether current agents introduce them when building the feature, and whether they catch them when asked to review it.

Keywords access control · multi-tenancy · coding agents

1Introduction

What it taught me

Further study. I want to understand technology more deeply, learn from people who see it differently, and experience new cultures along the way.