Karan Mali
Backend + Product Engineer
I build backend systems that hold under real traffic — multi-tenant architecture, data integrity, and zero-downtime migrations.
Recently at Ajar · property & rent-payments SaaS
- 44
- call sites re-architected for tenant isolation
- 55×
- faster server build — 6.6s → 119ms with esbuild
- 8 wks
- zero-to-store mobile app, built with AI
India · Remote · Open to backend & product roles
Lately rabbit-holing on SO_REUSEPORT and TCP internals. See what I'm working on now →
Engineering with AI
›Cut feature kickoff from hours to minutes
When a ticket is assigned, a Jira → GitHub Actions → Claude pipeline reads the codebase, drafts a plan and test scenarios, and commits them to a new branch.
12+ plans in the first month; the whole team now starts from it.
›Automated Arabic localization behind a human-review gate
A translator agent runs in CI before each deploy, translating the app into Arabic (full RTL). A human reviewer just approves the diff.
Localization ships continuously instead of blocking releases.
›Shipped a production mobile app in 8 weeksComing soon
Shipped the landlord mobile app end to end, using AI tooling for scaffolding, native plugin work, and the Android release pipeline (Fastlane → signed AAB → Firebase).
iOS + Android, 15+ screens, Arabic RTL, push notifications — zero to store in ~8 weeks.
Experience
Software Engineer · Ajar Online
Nov 2025 – PresentProperty-management & rent-payments SaaS · Remote
- Fixed a multi-tenant data-corruption bug where web and mobile sessions shared one global account context — a device could act on another's portfolio. Re-architected to request-scoped resolution (AsyncLocalStorage) across 44 service call sites; shipped in 3 files.
- Led a zero-downtime, six-phase migration deprecating a global account-id field across four codebases, with a metric-gated cutover held below 0.5% error rate for 7 days ending in a schema column drop.
- Found RBAC was enforced only on the client; catalogued IDOR vulnerabilities and built server-side RBAC middleware with integration tests.
- Built a centralized notification hub: queue-based multi-channel delivery (in-app, email, SMS) with per-user preferences and event triggers across lease and payment workflows.
- Integrated MyFatoorah payments: saved-card tokenization and a capture flow hardened with transactional rollback.
- Build & infra: cut the server build 6.6s → 119ms with esbuild, shrank the Docker image 65%, sped Angular CI 75%, and flagged a recurring CI-plan cost saving.
Software Developer · Autonomis
Dec 2024 – Oct 2025Data / reporting platform · Remote
- Engineered an RBAC system with fine-grained view/edit permissions per resource — admins control exactly who can read or write each resource across the platform.
- Architected multi-tenant infrastructure: organizations join via unique invite links, with centralized role management and instant access revocation.
- Established MIS reporting dashboards with customizable views, automating delivery through Airflow.
- Reduced bug-related downtime by ~50% by troubleshooting and hardening AI-generated backend code.
Backend Developer · PixelSaffron
Oct 2024 – Dec 2024E-commerce · Remote
- Built the backend for a clothing brand on MongoDB, Express, and Node.js.
- Integrated PhonePe and RazorPay with webhook-based real-time order updates, plus a wallet and coupon system.
- Optimized analytics through indexing and database views.
Writing
We replaced a $150/mo translation SaaS with a Claude Code agent that drafts Arabic translations — structural checks and human review keep it honest, and localization dropped from days to hours.
Unreliable AI output usually isn't a model problem; it's an onboarding one. I fed an agent our architecture, naming, and real code until its plans were good enough to run several tickets at once.
Building a polling-based notification system, I realized the scope was wrong — mobile and email were coming. On pressure-testing scope before you build.
How one difference between tsc and esbuild, const enum inlining, corrupted payment data in production, and what I did about it.
›The ORM Trap That Cost Me a Backend Job
July 2025Leaning on an ORM, missing the SQL underneath it, and what that cost me.
›Concurrency Can Kill Your Performance
Coming soonI thought merge sort was fast enough, until 10 million items. What Go's goroutines did to it, for better and worse.
›Two Processes on the Same Port
Coming soonSO_REUSEPORT, TCP 4-tuple hashing, and how the kernel actually load-balances across processes.
Projects
Captures Indian bank SMS, reconciles it against Excel statements, and auto-links transactions to SIP goals. Web + React Native.
- Go/Echo, SQLC + PostgreSQL on AWS Lambda, with an Asynq queue. Gemini parses the SMS; a reconciler fuzzy-matches statement rows with confidence scoring; SIP rules link transactions in the background.
- Live · 50+ documented endpoints · Go on AWS Lambda
A GitHub App that runs your commit diffs through an LLM and drafts blog posts, tweets, and LinkedIn updates on every push.
A tournament-management platform built on Go goroutines, so concurrent registrations and scheduling never collide.
- Goroutines + channels for high-throughput registration, scheduling, and result tracking with no race conditions.
- Concurrent-safe · Go + PostgreSQL · Dockerized
Drop in a YouTube URL, get a structured summary, and share it with per-user permissions. Handles hour-long videos without truncation.
An AI email manager with a custom job queue. Summarizes busy inboxes and flags the messages that need a reply.
How I learn
Rabbit-holing
My own way of learning: pick something that nags at me, dig until the mental model clicks, then write it up. Most of my posts start as a rabbit hole.
Low-level networking
SO_REUSEPORT, TCP internals, and eBPF — how packets actually get routed.
Go performance
Where the time and allocations really go, and how to get them back.