Mustafa Sezer Başar

Full-stack system encrypting employee PII field by field with AES-256-GCM: a key per subject makes erasure the destruction of that key (crypto-shredding); plus role-aware masking, a hash-chained audit log and 64 adversarial tests generated from the policy table. Compliance claims come from an evidence report that fails the build when dirty.

• TypeScript
• Express
• node:sqlite
• Node crypto (AES)

End-to-end system written to collect rates daily from several booking channels (Booking, Hotels and others), keep them as a time series, and turn them into a price recommendation: collection runs through a Chrome extension in a real browser session after the headless approach was stopped by bot protection, with history in PostgreSQL behind an Express API and a React + Recharts interface. The recommendation's distinguishing input is competitor occupancy — rates are public, occupancy is not. It binary-searches the channel's availability query by raising the room count, which reveals the remaining inventory the competitor is willing to show, then divides by their published room count. No reservation is ever created; it only reads the availability response any customer can see. To find out how accurate the method actually is, wrote an open-source study: in a simulated market where true occupancy is known, the naive reading is 35 points out and a censored-regression estimator 12 — but when the revenue effect was measured, the gain did not beat a one-line control needing no collector at all, and it was reported that way.

• TypeScript
• Express
• node:sqlite
• Chrome Extension

Commercially built product that lets a guest check in without going to the front desk. It reached production readiness but was never deployed: the hotel management system used in the region was closed to outside integration. Three steps: the guest uploads an ID or passport and its text is read with Tesseract, takes a photo of themselves, and the two faces are matched with face_recognition — then location is verified, because a face match proves who someone is, not that they are at the hotel. Face data is a special category under Turkish data protection law, so the flow opens with an explicit consent gate and a guest who declines checks in face to face instead: consent without an alternative is not consent. No photograph is kept: once the comparison is done, only the numeric representation of the face remains, and the hotel sets how long it is held — under the Turkish data protection act the hotel is the data controller, so that decision belongs there. There is no liveness check; the system can be fooled by a photograph held up to the camera, and the location check does not close that gap.

• Python
• Tesseract OCR
• face_recognition