Mohammad Taha
Menu
Email me

Open to internships and collaborative projects

From a clinic's booking desk to an ESP8266 water pump.

I'm Mohammad Taha, a computer science student at Chandigarh University and co-founder of NAVNA. I build full-stack systems with partners for real clients, and my own tools on the side.

See my workEmail me
Kartar Aarogyam home page: homeopathic consultations with Dr. Amritpal Kaur, with a consultation details card and a Book a consultation button.
Kartar Aarogyam
AlgoDraft workspace approving the strategy Buy EURUSD, EMA 20/50: the plain-English rules with each value highlighted, and a panel showing where each rule came from.
AlgoDraft
Kartar Aarogyam home page on a phone.

Built with partners for

Client work

Five systems built with partners. Each one says what it does, which part was mine, and links to the live site where there is one.

Kartar Aarogyam home page: homeopathic consultations with Dr. Amritpal Kaur, with a consultation details card and a Book a consultation button.
Kartar Aarogyam home page on a phone.
In developmentPrivate client repo

Kartar Aarogyam Wellness Centre

Website and booking system for a wellness centre

Virtual OPD booking, medicine inquiries and a secure admin dashboard for a wellness centre.

My part

  • Built the redesign of the public site (the “Parchi” visual system).
  • Built the three-step appointment booking flow and the Razorpay checkout backend.
  • Ran repeated critic-and-QA review rounds on the redesign — 56 items tracked in the first round alone.
  • +4
Read the case study
AlgoDraft workspace approving the strategy Buy EURUSD, EMA 20/50: the plain-English rules with each value highlighted, and a panel showing where each rule came from.
AlgoDraft landing page: Your trading idea, turned into exact rules.
Beta landing page livePrivate client repo

AlgoDraft

AI trading strategy platform

Turns a plain-English trading strategy into a validated spec and a demo-only MetaTrader 5 Expert Advisor.

My part

  • Co-built with partners. Individual contributions are not itemised here.
  • +2
Read the case studyBeta landing page
Property Tricity Live home page with the six area desks around the masthead.
Coverage map of the Chandigarh Tricity split into the six desk areas.
LivePrivate client repo

Property Tricity Live

Real estate media platform for the Chandigarh Tricity

Regional property media — interviews, news, ground reports and locality guides — with role-based publishing.

My part

  • Hardened auth, server actions and security headers.
  • Wrote the Vitest suite for permissions, schemas and helpers.
  • Fixed the login throttle so parallel requests couldn't bypass it and the owner couldn't be locked out.
  • Added shared SEO metadata and JSON-LD to every public page; accessibility pass on contrast, landmarks and focus after errors.
Read the case studyVisit the live site

How the systems decide

In every system below, the coral line separates what can't be trusted (people, AI models, the network) from the code that decides. Switch layers to see the outcome, the data flow, the guarantees, what's unfinished, and my part.

Booking request → confirmed slot

Open the case study
Untrusted inputEnforced on the serverPOSTinsertsessionPatientbooks Virtual OPDClinic staffadmin / super adminBooking formRHF + Zod in browserTurnstile tokenfrom the widgetRoute handlerZod · origin · limitsTurnstile verifyfails closedAdmin APIrequireAdminApi()D1 appointmentsunique slot_keyHourly cronreminders · cleanupR2 prescriptionsprivate bucketUntrusted inputEnforced on the serverPOSTinsertsessionPatientClinic staffBooking formTurnstile tokenRoute handlerTurnstile verifyAdmin APID1 appointmentsHourly cronR2 prescriptions
  • person
  • guesses / untrusted
  • decides
  • process
  • storage
  • third party
  • trust boundary

Boundary Where guessing stops and something deterministic decides.

  • A partial unique index on appointments.slot_key makes double-booking impossible at the database level. repo docs
  • Turnstile is verified on the server; without the secret, forms fail closed. repo docs
  • Every admin handler calls requireAdminApi(); prescriptions are only served through an admin-only route from a private bucket. repo docs
The drawing, in words

Kartar Aarogyam Wellness Centre: Booking request → confirmed slot. Left of the redline is “Untrusted input”; right of it is “Enforced on the server”.

  • Patient — books Virtual OPD (Untrusted input)
  • Clinic staff — admin / super admin (Untrusted input)
  • Booking form — RHF + Zod in browser (Untrusted input)
  • Turnstile token — from the widget (Untrusted input)
  • Route handler — Zod · origin · limits (Enforced on the server)
  • Turnstile verify — fails closed (Enforced on the server)
  • Admin API — requireAdminApi() (Enforced on the server)
  • D1 appointments — unique slot_key (Enforced on the server)
  • Hourly cron — reminders · cleanup (Enforced on the server)
  • R2 prescriptions — private bucket (Enforced on the server)

Connections

  • Patient → Booking form
  • Booking form → Route handler (POST)
  • Turnstile token → Turnstile verify
  • Turnstile verify → Route handler
  • Route handler → D1 appointments (insert)
  • Hourly cron → D1 appointments
  • Clinic staff → Admin API (session)
  • Admin API → R2 prescriptions

Personal projects

Things I built on my own or for coursework, from a lab-report generator to a soil-moisture pump.

Public repo

Lab-Forge

Upload an experiment sheet, get a finished lab report with code that was actually run.

Mochi Kitchen: What shall we cook today? A search box with diet filters and the Mochi cat mascot.
Live demo

Mochi Kitchen

A cute AI recipe finder using NLP, TheMealDB and Gemini.

Wiring diagram: soil moisture sensor and relay connected to an ESP8266 NodeMCU, a 9V battery driving a mini pump, and a power bank, linked to Blynk over Wi-Fi.
Blynk mobile dashboard for the Smart Irrigation System showing a moisture gauge at 729 and a pump switch.
Hardware prototype

Smart Irrigation System

Automated irrigation controller with an ESP8266, a soil-moisture sensor and the Blynk platform.

Runs locally

Vibe.cast

Weather dashboard with live conditions, a packing checklist and a short-term forecast.

The macOS-style dark calculator running in a browser.
Public repo

macOS Calculator (Web)

A macOS dark-mode calculator in vanilla JS that handles operator overwriting and sign-toggling.

Desktop app

QuizMaster Pro

A Java Swing quiz app with custom-drawn components, lifelines and per-user history.

Layout sketch of the Ink Wave blog from its repository.
Runs locally

Ink Wave

A blog built with Node and EJS, with posts persisted in SQLite.

Earlier work

Course projects and my first sites, kept for the record.

What I build with

Every technology here is used by at least one project on this site. The number is how many; the chips take you to them.

Languages

Frameworks & libraries

Platforms & hosting

Data

Quality & security

AI & APIs

Hardware

Also on my LinkedIn, without a public repository here

  • An AI website chatbot built on the OpenAI API, for site assistance and query handling.
  • Telegram automation bots in Python using the Telegram Bot API.
  • Further IoT automation builds: automated water dispensing and ventilation control.

Listed skills not backed by a project above: MongoDB, Telegram Bot API, Networking, Unix.

Engineering notes

Short write-ups of single decisions. Code is copied unedited from the public repositories.

Kartar Aarogyam Wellness Centrerepo docs

Let the database say no

Two patients can open the same free slot at the same moment. A check in the browser — or even in the route handler — can't stop both requests from passing it.

Kartar Aarogyam puts the rule where the race ends: a partial unique index on appointments.slot_key that covers every pending or confirmed booking. The second insert fails; nobody gets a confirmation for a slot that's already taken.

The index is my partner's work. I built the three-step booking flow that writes into it.

Lab-Forgecode

Running generated code without handing it your keys

Lab-Forge compiles and runs code a model just wrote. The server that does this also holds API keys for several AI providers.

So every child process starts from an allow-listed environment, with its own temp folder as HOME, and is killed as a whole process group on timeout. A Docker backend can go further, with a throwaway container per run and no network. The free host can't nest containers, though, so the live app uses loopback-only guards instead, and the docs say what that doesn't stop.

Lab-Forge/core/execution/runner.py
def _clean_env(wd: Path, extra: dict) -> dict:
    """Child processes get a minimal environment: no API keys, no secrets."""
    env = {k: v for k, v in os.environ.items() if k.upper() in _SAFE_ENV}
    tmp = str(wd.resolve())
    env.update({
        "TEMP": tmp, "TMP": tmp, "TMPDIR": tmp, "HOME": tmp, "USERPROFILE": tmp,

Smart Irrigation Systemcode

A pump that waits

Water takes a while to reach a soil sensor. A controller that pumps whenever it reads “dry” keeps pumping until the reading catches up.

The irrigation firmware is a three-state machine: monitor, pump for 3 s, then wait 40 s before acting on the sensor again. It keeps reading and reporting during the wait, and uses millis() instead of delay(), so Wi-Fi and Blynk stay responsive the whole time.

smart-irrigation-system-iot/code/SMART_IRRIGATION.ino
  // Pump currently running
  if (pumpRunning) {

    if (currentTime - pumpStartTime >= PUMP_DURATION) {

      setPump(false);

      pumpRunning = false;
      waitingPhase = true;

Mochi Kitchenrepo docs

From 40 seconds to about 4: moving a Worker next to its data

Mochi Kitchen's D1 database lives in Tokyo. A recipe search makes dozens of small queries, and from a Worker on another continent each one cost about 250 ms — searches took up to 40 s.

Pinning the Worker's placement next to the database brought searches to about 1–4 s. The fix was one placement setting in wrangler.jsonc, not new code.

macOS Calculator (Web)code

Operator precedence without eval()

The calculator splits the display into numbers and operators, collapses every × and ÷ in place, then sums + and − left to right. No eval(), no parser library — two passes over an array.

MacOS-Calculator-Web/script.js
    let list = display.innerText.split(/([+\-×÷])/);

About me

Portrait of Mohammad Taha.

Based inChandigarh, India

StudyingB.E. Computer Science & Engineering, Chandigarh University, 2024 – 2028

I study Computer Science & Engineering at Chandigarh University and co-founded NAVNA, a small web and technology agency, in 2026.

Most of my recent work is with partners on client systems: a clinic's booking platform, a property newsroom, a trading-strategy tool. Alongside that I build my own projects, from a lab-report generator that runs the code it writes to an ESP8266 irrigation controller.

The work I enjoy most sits behind the interface: data models, validation, auth, the scripts that deploy it, and the tests that say whether it still works.

Before and alongside code

  1. Apr – Oct 2025

    Project Manager (part-time, remote) at CognitechAI

    Planned and coordinated corporate training projects and designed e-learning course content.

  2. 2022 – 2024

    Founder & administrator at English Club

    Started and ran a club organising speaking practice for its members.

  3. 2020 – 2024

    Content creator at YouTube

    Ran a channel that reached 1.3K+ subscribers: content, video editing and publishing.