Hi, I'm

Nader Khalil

Full-Stack Software Engineer | Web Applications & Applied AI

B.Sc. in Software Engineering

I like building software that's easy to use and hard to break. I build web apps and AI assistants that people can rely on, and as a software engineering graduate now training at 42 Abu Dhabi, I pick up new tools quickly and work well both individually and in a team.

View Résumé See My Work
Nader Khalil

Featured Projects

AI Booking Platform

Case study

Booking engine + AI assistant

A booking engine any appointment business can run from configuration, with an AI assistant that answers from the business's own knowledge base and never acts without the user's confirmation. Each business is defined by a single profile: its names, booking rules, and knowledge.

Try it: one click as a client, advisor, or admin; no sign-up.

  • 93%cached input, lower cost
  • 700+automated tests
  • 120live AI checks passing
  • 2businesses, one codebase

Engineering highlights

  • The AI can't act alone. Suggested bookings and cancellations need your confirmation before they run.
  • A knowledge base admins run themselves. Add, edit, or upload documents, group them in sections, and pick which roles may read each; the assistant cites only what that user can see.
  • Answers follow the settings. Change a booking rule in Admin and the assistant quotes the new value, with citations.
  • Secure by default. Roles are re-checked on every request, every input is validated, and sign-in and the assistant are rate-limited.
Next.js TypeScript PostgreSQL pgvector RAG Tool Calling Playwright CI

Student-Faculty Services v2

Capstone rewrite in plain PHP and React

A full rewrite of my senior capstone: students book 5 to 45 minute office-hour slots, and faculty set their hours, closures, booking rules, and approvals. Undo, reminders, ratings, and a waitlist are built in.

Try it: one click as a student or faculty member; no sign-up.

  • 0double bookings in an 8-student race
  • 46API endpoints, no framework
  • 100/100Lighthouse accessibility

Engineering highlights

  • Ten booking rules, one transaction. Notice, overlaps, limits and closures are checked together, all or nothing.
  • Undo that re-checks every rule. Cancellations and closures can be undone for 10 seconds, and the slot stays held until then.
  • Reliable reminders. One a day before, in the app or by email, cancelled with the appointment and never sent twice.
  • Tested before every deploy. 500+ PHPUnit, Vitest, and Playwright tests, including accessibility checks, must pass before GitHub Actions deploys.
React TypeScript PHP MariaDB Playwright PHPUnit GitHub Actions Accessibility

42 Intra Logtime Calculator

Chrome Extension (Published)

A published, lightweight Chrome extension with 60+ users that adds live logtime calculations to the 42 Intra interface: total monthly hours in the header, and totals for any date range you drag across the calendar. It runs entirely client-side and supports both the legacy and V3 Intra layouts.

  • 60+installed users
  • 0data collected
  • 19 KBextension size
  • 2Intra layouts
JavaScript Chrome Extension Client-Side DOM

More projects

The AI Appointment Scheduler, a Docker infrastructure project (Inception), a multi-agent hackathon prototype, and nine systems projects from 42 Abu Dhabi in C and C++, including minishell, philosophers, ft_irc, and cub3D.

View all projects

Professional Experience

Jul 2026 – Aug 2026

AI Trainer & Mentor

Department of Education and Knowledge (ADEK)

  • Delivered technical instruction on agentic workflows, prompt structuring, and autonomous tool calling for the accredited AgenticVerse program.
  • Mentored cohort teams building functional AI prototypes addressing real problem statements from ADNOC, FANR, and Khalifa Fund.
  • Provided technical troubleshooting and support for participants experiencing environment setup issues and configuration errors.
  • Guided students through code debugging, API schema validation, and structured output parsing, communicating complex technical concepts clearly to enable independent problem resolution.
Jan 2026

QA & Software Tester

42 Abu Dhabi

  • Conducted functional and UI testing on an internal student platform using black-box testing and use-case scenarios to identify bugs before release.
  • Tested features across browsers and screen sizes to catch responsive and layout issues before deployment.
  • Re-tested fixes and checked related flows to confirm bugs were resolved without regressions.
  • Wrote detailed bug reports with clear reproduction steps to help technical teams isolate and resolve issues quickly.
Dec 2025

IT Support & Technical Staff

Ticketmaster

  • Provisioned and deployed specialized entry ticketing systems and scanner hardware for a high-volume international event.
  • Served as the on-site technical point of contact, delivering rapid incident resolution under strict, time-sensitive conditions.
  • Performed system health checks and connectivity audits, maintaining 100% operational uptime for entry points throughout the event.
Jan 2024 – Apr 2024

Software Engineering Intern

Timex IT Consulting

  • Built C# MinimalAPI endpoints supporting sorting, pagination, and file handling.
  • Implemented request validation and standardized HTTP response handling across CRUD services.
  • Supported software release rollouts by identifying and documenting functional bugs in proprietary accounting software.
  • Coordinated with developers to verify technical fixes based on defect reports before client deployment.

Technical Skills

Frontend
React · Next.js · TypeScript · Vite · TanStack Query · Tailwind CSS · Accessible UI (axe)
Backend
REST APIs · Layered architecture · Zod · Auth.js · PHP · C# MinimalAPI
Data & security
PostgreSQL + pgvector · MariaDB · Prisma · Row locks · CSP · CSRF · Rate limiting · CTF
AI
LLM integration · Tool calling with human review · RAG · Embeddings · LLM evals · Prompt caching · Vercel AI SDK
Testing & CI
Vitest · Playwright · PHPUnit · Race tests · GitHub Actions · Dependency audits · Docker
Languages
TypeScript · JavaScript · Python · C · C++ · C# · Linux

Practices: clean, maintainable code with clear separation of concerns, refactoring, technical decisions and their trade-offs, technical documentation and decision logs, pull-request workflow, mentoring and technical communication, self-directed learning.

Education & Certifications

B.Sc. in Software Engineering

Al Ain University, Abu Dhabi

Comprehensive 4-year program grounded in the full Software Development Life Cycle (SDLC), covering requirements engineering, system architecture, and design patterns. Built strong foundations in OOP, relational database design, data structures, and systematic software testing.

View degree attestation

Computer Science Diploma

42 Abu Dhabi

Intensive, peer-driven program with no lectures and no teachers. Every project is self-directed: I read the requirements, build from scratch, and test my own work in C, C++, and Unix systems. This is where I learned to teach myself.

Certificates & Achievements

AgenticVerse AI Summer Program, Mentor Certificate of Participation · 42 Abu Dhabi
MOEI × 42 Abu Dhabi AgentEra AI Hackathon Certificate of Appreciation
CyberQ CTF, Top 10 Finalist UAE Cybersecurity Council
Hack The Box University CTF: Tinsel Trouble Certificate of Participation · 119th of 1,014 teams
AI on Watch with Datamind RecognAIze Hackathon · Certificate of Participation
UAE Game Makers Competition, Exceptional Nomination Certificate of Recognition · Endless Studios

About Me

I'm a software engineer based in Abu Dhabi who's comfortable on both sides of the conversation: building the thing, and explaining it. Having worked across development, IT support, and QA, I've seen the same system from the view of the people who build it, run it, and use it, and I try to write code with all three in mind.

Teamwork has been a constant. University projects taught me how to split work, agree on conventions, and deliver together, and at 42 Abu Dhabi, where there are no teachers, learning happens by reviewing each other's work. In hackathons and CTFs I've coordinated with teammates under tight deadlines to get something working.

Mentoring students in AI through ADEK's AgenticVerse program sharpened my communication: I explain technical ideas plainly to people with different backgrounds and keep others in the loop. I also adapt quickly. I read the situation, learn what it needs, and get on with it, whether that's a new language, a different way of working, or a switch between building, testing, and supporting.

I work in Arabic and English, and I'm happiest turning a vague idea into something clear that works.

4 yrs B.Sc. Software Engineering
4 Professional Roles
Full-Stack Web & Applied AI
AR/EN Bilingual (Native Arabic)

Let's Connect

If you have a role, a project, or a technical question, I'm happy to chat.

Open to work · Flexible start

nader_khalil@outlook.com Abu Dhabi, UAE
LinkedIn GitHub Résumé

Full project details

AI Booking Platform

One booking engine for any appointment business: a business is configuration, not code. Clients book from a live calendar, and an AI assistant answers from a knowledge base the admin manages, with citations, and only acts after the user confirms. The sample business, people, prices and policies are fictional.

Live demo Read the case study

Features

Clients

  • Browse every advisor's open slots on a week, month or list calendar, filter by practice area, and book in one click with an optional note
  • Reschedule, cancel and undo, export to a calendar app (.ics), and get reminders and live notifications

Advisors

  • Publish availability as single slots, back-to-back runs or weekly repeats, and close or reopen slots
  • Move or cancel appointments, and undo their own changes for 15 minutes

Admins

  • An overview, user management (create advisors, edit, deactivate), appointment cancellation, and a cross-user activity log
  • Settings without a deploy: booking rules within the engine's safe range, feature toggles (rescheduling, note edits, weekly repeats, undo, a required cancellation reason), per-account abuse limits and the registration policy, effective immediately, journaled, and quoted by the assistant
  • Knowledge base: create, edit, upload, delete and restore the documents the assistant answers from, each visible to everyone or to chosen roles, organised in sections

AI assistant

  • Scoped to each role; answers questions about services and policies with citations
  • Prepares bookings, reschedules, cancellations, notes and slot changes as confirmation cards that run only after you confirm
  • Understands follow-ups, relative dates and Arabic, never invents prices, and leaves case-specific advice to a consultation

Everyone

  • One-click guest sign-in for client, advisor and admin, with a weekly sample-data refresh

Technical details

Architecture

  • Next.js 16 (App Router), React 19, TypeScript in strict mode and Tailwind CSS 4
  • Route handlers validate every input with Zod
  • One write path: every change goes through lib/services (checks, then a transaction that journals the change for undo); limits live in lib/rules.ts, which feeds enforcement, the rules popover, the assistant's prompt and the tests
  • Everything is entered and shown in the business's time zone (IANA, DST-safe)

The business is configuration

  • The code never names its domain: what clients, providers and appointments are called, the field labels, landing copy, the assistant's scope, demo personas, knowledge base and seed data all come from one domain profile
  • Two profiles ship side by side (a business-setup consultancy and a university), and a unit test fails if a profile's words leak into code

Configurable knowledge base

  • Admins manage it in the app, with no deploy: create and edit documents, upload up to 20 markdown or text files in one all-or-nothing batch, hide and restore them, and file them under sections they add, rename and reorder
  • Per-role visibility: each document, and each section's default for new ones, is visible to everyone or to any set of roles, and retrieval filters on that in SQL, so the assistant never cites a document the asking role can't read
  • Rules feed the assistant: the booking-rules document and the role guides are rendered from templates with the current settings, so a rule changed in Admin is quoted by the assistant straight away
  • One write path: every edit, upload and rule change is chunked, embedded and written through the same service, journaled, and searchable and filterable in the database
  • Safe by construction: uploads are text-only, size-capped by counting bytes and never written to disk, and invisible or bidirectional text is rejected, with an adversarial test suite behind it
  • On the public demo, the shared guest admin's changes expire after 24 hours

Data and concurrency

  • PostgreSQL 16 with pgvector through Prisma 7
  • A slot is claimed with a conditional update; the client's row is locked so overlap and fairness checks (no double-booking, at most 2 upcoming appointments per advisor) cannot race
  • Concurrency is tested against a real Postgres

AI assistant

  • Retrieval: documents are chunked (about 600 tokens, 12% overlap), embedded as 384-dimension vectors and fetched from pgvector, with each role retrieving only its own guide, filtered in SQL
  • Generation: DeepSeek through the Vercel AI SDK with 15 role-scoped tools and streamed answers with citations
  • Safety: tools only return proposals, a confirmation calls the same REST API a click would, and client-sent tool output is discarded
  • Cost: the prompt layout keeps 93–94% of the assistant's input served from the provider's cache on full live runs
  • Evaluation: a retrieval eval of 22 golden questions and a live suite of about 120 checks (injection, data leaks, scope, ambiguity, Arabic, multi-turn) that gates prompt changes

Security

  • Roles and deactivation are re-checked from the database on every request; nonce-based CSP and HSTS; bcrypt passwords; per-user and per-IP rate limits (Upstash)
  • A public admin login that can't break the demo: the guest admin can't lift abuse limits or close registration, its knowledge changes expire after 24 hours, and stale forms get a conflict instead of overwriting a newer change
  • Sentry error tracking with personal-data collection off; Dependabot and a CI dependency audit

Testing and delivery

  • 340 unit, 302 integration (against Postgres) and 84 end-to-end tests, including axe accessibility scans (WCAG 2.1 AA) in light and dark
  • CI on every push; a Docker image on Render with Neon (Postgres and pgvector), expand-then-contract migrations so the live site keeps working while the database changes, and a weekly sample-data refresh

Full project details

Student-Faculty Services v2

A full rewrite of my senior capstone: students book time in faculty office hours, and faculty manage their hours, closures and booking rules. An unofficial student project; faculty names, ranks and colleges come from AAU's public staff pages, and everything else in the demo is sample data.

Live demo

Features

Students

  • Faculty directory: search by name or college, with each person's next free time
  • Faculty profiles: details, weekly office hours with their rooms or online meetings, and rating averages once there are three ratings
  • Booking grid for the next 7 days: pick a session length (5, 15, 30 or 45 minutes) with free-slot counts per length; times inside a faculty member's minimum notice show as "Too soon"
  • Limits: at most 5 upcoming appointments, one per faculty member per day, and no overlaps
  • Cancel with a 10-second undo
  • Waitlist when nothing is free (up to 5 at once): one alert when a time opens, in the app and by email if enabled
  • Ratings after an attended appointment: three 1-5 criteria within 14 days, anonymous to faculty
  • Reminders the day before each appointment and before the rating window closes, plus optional email with a verified address
  • Profile with name, major and photo; sign-up with an AAU-format student ID and a "Suggest an ID" helper

Faculty

  • Dashboard with today's appointments and Close now for emergencies
  • Weekly office-hours blocks (1.5 hours, up to two a day), each in a campus room or online; editing or removing one previews which bookings it would cancel
  • Closures: close a range of time with a preview of who is affected; a 10-second undo restores their bookings, and students are told once it is final
  • Booking rules: minimum notice, session lengths offered, and a gap around each appointment; they apply to new bookings only
  • Approvals: mark finished appointments attended or not, with an optional report, which opens rating for the student

Everyone

  • Notification bell (checked every minute while the tab is visible): bookings, cancellations, closures, reminders, approvals, rating requests and "a time is free"; shows the newest 30 with Show older and Clear read
  • Light and dark themes, phone layouts, and short tips on every page
  • Demo: one-click student and faculty accounts, or sign in as any of the 155 faculty and 200 sample students; the demo resets itself weekly

Technical details

Architecture

  • React 19, TypeScript, Vite, React Router and TanStack Query on the front end
  • A layered, framework-free PHP 8.4 API: router, controllers, services and repositories over PDO, with 46 REST endpoints (28 of them write endpoints)
  • MariaDB 11.4 with 13 tables (11 foreign keys, 11 CHECK constraints and 4 unique keys)
  • All times use Asia/Dubai through one clock that tests can freeze

Booking correctness

  • One transaction locks the student row, then the faculty row (always in that order, so bookings cannot deadlock) and checks ten rules
  • Tested three ways: a test holding a shared lock from a second connection, eight students racing for one slot over real HTTP (exactly one wins), and every rule checked in SQL at four times of the week; the race test fails without the lock
  • Undo: a cancelled time is held for 15 seconds (the interface offers 10), the other side's notification is dated at the end of the window, and undo re-checks every rule under the same locks; an undo racing seven bookings always wins

Reminders, email and upkeep

  • Reminders are claimed with a conditional update, so each is created once; optional emails go through an outbox, are scheduled ahead, and one whose reason is gone is never sent
  • Email addresses are verified with a click that needs a real button press, so mail scanners cannot confirm them
  • New database migrations, the weekly demo reset and reminders run automatically on the first request that needs them, under database locks; a test proves the original schema plus every migration equals the current schema

Security

  • Prepared statements (real server-side prepares) for every query that takes user input; ownership is checked in the SQL itself
  • A CSRF token is required on all 28 write endpoints; login throttling by email and IP; strict sessions with a new ID on login and logout
  • Uploaded photos are re-encoded to WebP, which drops metadata and hidden payloads; security headers are set on responses

Testing and delivery

  • 339 PHPUnit tests (unit tests and feature tests through the real router), plus real-HTTP tests through Apache, 143 Vitest tests, and 20 Playwright tests that run on desktop and phone with axe accessibility checks in light and dark mode
  • The booking race test was proven by removing the lock: without it, it produced double bookings; Lighthouse scores 100 for accessibility and best practices on the login page
  • GitHub Actions runs the web and API checks, integration tests and a production-layout check, and deploys only when everything passes; local development and CI use the same MariaDB version as production
  • A README with architecture and data-model diagrams, a handoff guide for new developers, and a deploy guide with the migration procedure