CodeQL flagged 34 alerts in my SQL client. I wrote the worst one
Four “SQL injection” alerts in an app built to run your SQL, one real bug of my own making, and how 34 alerts went to zero with tests.
Stiliyan Stoyanov
I’m a forward-deployed engineer at Catwing AI, building web products with TypeScript and React, backends in Python/Django and Node.js, and local-first desktop apps with Rust and Tauri.
I care about software that holds up in production: thoughtful architecture, tests, security, and clear documentation.
Based in Varna, Bulgaria. Studying Software and Internet Technologies at the Technical University of Varna.
Currently
- Forward-deployed engineer at Catwing AI — Python/Django services, React + TypeScript frontends, and AWS.
- Studying Software and Internet Technologies at the Technical University of Varna, 2026–2030.
- Open to remote part-time employment (EET/EEST, UTC+2/+3).
Notes
Sprout: building a programming language in C 6 posts
A beginner’s language written from scratch in C, and the hardest parts of building its interpreter.
MCP without the hand-waving
What MCP is, how its versions differ, where it beats a direct API integration, and where production servers go wrong.
Local-first desktop software in Tauri: what Rust has to own
How inkwell and MamaSQL keep data on disk, secrets in the keychain and every network call listed.
One core, two front doors: a CLI for people, MCP for agents
How frameatlas gives a person and an AI agent one shared ledger, so a reviewer can audit exactly what the agent was shown.
Selected projects
Sprout
A beginner-friendly programming language written from scratch in C, with plain-English keywords, helpful errors, zero dependencies, and an in-browser playground through WebAssembly.
code · playground · write-up
BaseworkSaaS
A multi-tenant SaaS starter with organizations and RBAC, Stripe billing, usage-based credit metering, admin impersonation, and audit logs—designed to run locally with zero configuration.
inkwell.md
A local-first research workspace for Windows with linked Markdown notes, wikilinks, a knowledge graph, search, and tags—bringing reading notes and structured writing into one application.
frameatlas
A Python CLI and MCP server that extracts every video frame with exact timestamps, giving AI agents and human reviewers a browser viewer and reliable coverage tracking.
Codemonkey
A minimalist typing-speed test for developers. Instead of prose, it uses real code snippets from ten languages and reports speed, accuracy, and consistency.
Stack
Languages: TypeScript, JavaScript, Python, Rust, C, SQL
Frontend: React, Next.js, modern browser APIs
Backend & data: Django, Node.js, PostgreSQL, MySQL, SQLite
Desktop & tooling: Tauri, WebAssembly, AWS, Docker, GitHub Actions