Mohamed Sharaf.
At the keyboard since 1996
A small corner of a very big internet

Still
curious.

I’m Mohamed Sharaf.

My first computer was in 1996. By 2000, I was doing security for a living. In 2002, I started my own company, and it’s still running.

Three decades on, I still enjoy the same thing: opening a system up, finding where it breaks, and making it hold.

Security · Infrastructure · Software · AI

These days I help startups, small businesses and government teams make their systems safer and simpler. Sometimes with an hour of advice. Sometimes with a proper review.

How I can help Reach me
From Cairo  ·  Living in Riyadh  ·  Dad. Always a beginner.
Photo of Mohamed Sharaf
MOHAMED_SHARAF
Every system has a “what if?”I like finding it first.
FIG. 01 / A work in progressJust like this website ↗
30yrsWith computers
26yrsIn security
24yrsRunning my own company
100KPeople live at once, back in 2005
0Client names on this site. Ever.
01 / The long way here

A few decades.
Same instinct.

Technology keeps changing. The urge to open it up, understand how it works and see what happens? That part stays.

  1. First computer.

    BASIC, Windows 3.11 and a blinking cursor that did what I typed. That was enough. I was hooked.

  2. Security, for real.

    Curiosity turned into work: testing systems, finding the holes and helping people close them before someone else found them.

  3. My own company.

    Domains, hosting, managed dedicated servers, websites and voice chat rooms. By 2005: about 500 sites and 2,000+ rooms. It’s still running today.

  4. Graduated. And this domain.

    A BSc in Information Technology from Menoufia University, earned while running the company. The same year, I claimed this small corner of the internet.

  5. Still building.

    Leading technical work in the public sector, and finding out where AI actually helps, safely.

The code side

I never stopped writing code.

Security and consulting get the headlines, but the code never stopped. It started with BASIC on that first computer. Then came C and C++, Java, C# and ASP.NET, and PHP, which I only truly fell for once Laravel came along. Phones brought Ionic and Flutter. These days it’s mostly Rust, Go, Node.js and TypeScript.

The newest proof: I built a password generator because I wanted one I could trust. Then I thought, why keep it to myself? It’s now Sharaf Tools: 25+ free tools in 10 languages, on the web, iOS and Android, and everything runs in your browser.

Try Sharaf Tools
Where it began
BASIC
Along the way
C · C++ · Java · C# · ASP.NET · PHP
The favourite
Laravel, the reason I love PHP
On phones
Ionic · Flutter
Every day now
Rust · Go · Node.js · TypeScript · JavaScript
02 / Field notes

Things I’ve seen.
Things I learned.

Five stories from three decades of servers, systems and security. No client names, and the details are blurred on purpose. The lessons are real.

01The server that started talking to strangersHosting · Incident response
The situation

Run hosting long enough and it happens: a customer’s server starts sending traffic it has no business sending. Usually at night. Usually on a weekend.

What I did

Contain first, ask questions second. Cut it off, keep the evidence, find the way in, often an old forgotten script. Then rebuild clean and close that same hole on every other server, not just this one.

What stayed with me

Incidents aren’t solved at 3 a.m. They’re solved by what you prepared before 3 a.m.

02The backup nobody had testedInfrastructure · Resilience
The situation

Everyone says they have backups. Far fewer people have ever restored one. You find out which kind you are on the day a disk dies.

What I did

Treat the restore as the real product. Scheduled restore tests, copies in more than one place, and a short written plan for what comes back first and who does what.

What stayed with me

A backup you’ve never restored is a hope, not a plan.

03100,000 people talking at once. In 2005.Hosting · Real-time scale
The situation

By 2005 we were running around 500 websites and more than 2,000 voice chat rooms. On a busy night, 50,000 to 100,000 people were live at the same moment, talking over the slow home internet of the time. Just our own servers, our own code, and us.

Didn’t exist yet:CloudAutoscalingNode.jsGoRustDockerKubernetes

We made it work anyway :)

What I did

Plan for the busiest night, not the average one. Spread the rooms across servers so one failure never took everyone down. Watch the load all evening, keep abusive users out, and keep the setup simple enough to fix while people were still talking.

What stayed with me

People forgive slow. They don’t forgive gone.

04The test that found the front door openPenetration testing · Audits
The situation

Teams expect a security test to find something clever. Most of the time it finds something simple that has been sitting there for years.

What I did

Default passwords, admin panels open to the whole internet, old software nobody owned anymore. Test like an attacker, then write it up so a busy manager can act on it: what’s wrong, how bad it is, what to fix first.

What stayed with me

Fix the boring things first. Attackers love boring.

05Security on the whiteboard, not the checklistSecure systems · Large organisations
The situation

Big systems with many users and sensitive data, where a mistake isn’t just a bug. It’s a headline, and sometimes a lot worse.

What I did

Bring security into the design meeting instead of the launch checklist: who can see what, what gets logged, what happens when a part fails, and how we’ll prove all of it later.

What stayed with me

The cheapest security fix is the one you make on the whiteboard.

Every story is shared with the people involved kept anonymous. That’s how I’d treat yours, too.

Latest notes

All 324 notes
  1. Security · 27 October 2026File uploads: the door we keep leaving open
  2. Infrastructure · 26 October 2026Put every renewal date in one calendar
  3. AI · 23 October 2026LiteLLM hit again: protect your release pipeline
03 / What I do

Four things.
Done properly.

I’ve done a lot of things over the years. These are the ones I’m good at, and still enjoy.

01 / Since 2000

Security

Find the holes before someone else does, and help you close them. If something has already gone wrong, help you contain it calmly.

  • Penetration testing
  • Security audits
  • Building secure systems
  • Incident response
02 / Since 2002

Infrastructure

More than twenty years of keeping servers alive. I’ll help you set things up so they’re boring, in the best possible way.

  • Servers, hosting & cloud
  • Networks & access
  • Backups that actually restore
  • Uptime & monitoring
03 / Always

Software & architecture

Look at how a system is built before it gets expensive to change. Fewer moving parts, clearer boundaries, less to go wrong.

  • Architecture reviews
  • APIs & data design
  • Secure development practice
  • Technical due diligence
04 / Now

AI, carefully

Use AI where it really saves time, and keep your data safe while you do. No magic promises, just honest testing of what works.

  • Where AI fits, and where it doesn’t
  • Safe use of company data
  • Practical automations
  • Build-or-buy advice
In practice

Some of what that looked like.

Ten things from the last 26 years. No names, as always.

  • Incident responseContained a weekend server compromise within hours, found the way in, and closed the same gap on every other server.
  • Penetration testingTurned a penetration test into a short priority list, so the team fixed what was truly dangerous first.
  • Security auditExplained audit results to a government team in language both engineers and management could act on.
  • Secure designJoined design meetings early, so security became part of the plan instead of a launch-day checklist.
  • BackupsAsked a team to actually restore their backups. They now test restores on a schedule.
  • InfrastructureTook servers from “hope it holds” to boring and predictable.
  • Second opinionTold a founder their plan was over-engineered, and showed a simpler path that cost far less.
  • Senior voice on callActed as the senior technical voice for a small team, without them needing a full-time CTO.
  • AI, carefullyShowed a company where AI really saves time, and where it doesn’t, without putting their data at risk.
  • Long-termSome clients still call me years later, when something has to be done properly.
04 / How we can partner

Senior firepower.
Direct leverage.

Three ways to start. You work with me directly. No agency layers, no junior handoffs. Startups, small businesses and government teams in Egypt, the Gulf, Europe or anywhere else. Remote by default.

01A conversation

A second opinion

One call. Bring a plan, a problem or a question you can’t get a straight answer to. You leave with an honest view from someone who has seen it before.

GOOD FORFounders and managers asking “is this a good idea?”

Ask for a call ↗
02A focused review

A test or an audit

A penetration test, security audit or architecture review with a clear written report: what’s wrong, how serious it is and what to fix first. In plain language.

GOOD FORTeams about to launch, or after a scare

Ask about a review ↗
03Ongoing

A senior voice on call

Fractional CTO or security advisor for teams that need experienced judgment more than another full-time hire.

GOOD FORGrowing teams without a senior technical lead

Let’s talk ↗

You won’t find client testimonials here. People hire me partly because I don’t talk about them, and I’ll treat your work the same way.

No client names, everPlain-language reportsRemote-first
05 / Away from the keyboard

There’s a whole
life off-screen.

I’m also a dad to two sons and a daughter.
A very human part of a very digital life.

Egyptian, from Cairo. Living in Riyadh. And one day, God willing, I hope to spend the rest of my life in Madinah.

Three decades of technology taught me one thing for sure: the best systems give people their time back.

THE MOST PERSONAL PART
My favourite little universe.

2 SONS + 1 DAUGHTER = A FULL HEART

06 / Play while you’re here

Before you go,
play a little.

Three small toys from three eras. Nothing to install, nothing to sign up for. Just a little of the fun that got me started.

Another chapter. Same curiosity.

From BASIC to AI, I’ve watched computing reinvent itself again and again. The tools change. The questions don’t: how does it work, where does it break, and can we trust it?

TodayAIStill learning
One small rule, many possibilities. Try it.
A LITTLE BEAUTIFUL UNPREDICTABILITY
POSSIBILITY / 001

A SMALL GENERATIVE-CODE TOY. MADE IN YOUR BROWSER.
NO AI MODEL RUNNING HERE — JUST AN INVITATION TO PLAY.

07 / You made it this far

Say hello.

Open to good conversations

A system you’re worried about? An idea that needs a second opinion? Or you just remember your first computer too? Write to me. I read everything.

Straight to my inbox. No newsletter, ever.

What happens after you write

  1. I read it myself.I usually reply within 2 working days.
  2. A short call, if it helps.Only when talking is quicker than writing.
  3. A clear proposal.In plain language: what I’d look at, how, and how long it takes.