# Omar Tsai

> Cybersecurity researcher and AI engineer. OSCP/OSWE/OSDA certified. M.Sc. Interested in API security, LLM-assisted security testing, and AI-powered cyber defence.

Personal website: https://thaomar.com  
Email: omar@9tsai.ca  
GitHub: https://github.com/omar2535

> Full blog content available at: https://thaomar.com/llms-full.txt

## Blog

Personal writing on cybersecurity certifications, tools, life reflections, and technical guides.

- [School Closed](https://thaomar.com/blog/2020-03-14-schools-closed/): UBC closes for the rest of term due to COVID-19.
- [Volatile Markets](https://thaomar.com/blog/2020-03-17-volatile-markets/): Thoughts on the COVID bear market.
- [OSCP — Attempt 1](https://thaomar.com/blog/2020-07-19-oscp-attempt-1/): Lessons learned from failing the OSCP exam on the first attempt.
- [VSCode Markdown PDF Export in WSL1](https://thaomar.com/blog/2020-07-29-vscode-markdown-pdf-wsl/): Guide to getting the VSCode Markdown PDF extension working in WSL1.
- [Passed OSCP!](https://thaomar.com/blog/2020-08-30-passed-oscp/): Passing OSCP on the second attempt.
- [Closing Out 2020](https://thaomar.com/blog/2020-12-30-closing-out-2020/): Annual reflection on 2020 — pandemic, markets, and what's next.
- [Graduation!](https://thaomar.com/blog/2021-06-03-graduation/): Five years at UBC and earning a B.Sc. in Computer Science.
- [AWAE & OSWE — A Review from a Software Developer](https://thaomar.com/blog/2021-09-01-oswe-review/): Review of the Offensive Security AWAE course and OSWE exam.
- [2021: A Year of Digital Experiences](https://thaomar.com/blog/2022-01-09-reflection-2021/): Annual review covering grad school, relationships, and goals for 2022.
- [Meaningful Work & Meaningful Relationships](https://thaomar.com/blog/2022-07-03-meaningful-work-and-relationships/): Reflections inspired by Ray Dalio and Robert Kiyosaki during the mid-2022 market pullback.
- [Setting Up Vulnserver for OSED Practice](https://thaomar.com/blog/2022-09-21-vulnserver-for-osed/): How to set up a Windows 10 VM with Vulnserver, WinDBG, and IDA Free for OSED lab practice.
- [Updating Wazuh Manager Password in Kubernetes](https://thaomar.com/blog/2025-11-06-wazuh-kubernetes/): Guide to rotating the Wazuh manager password in a Kubernetes deployment.

## Projects

- [GraphQLer](https://thaomar.com/projects/graphqler/): The only dependency-aware GraphQL API security testing tool. Automatically generates valid queries and mutations, resolves object dependencies, and detects vulnerabilities including IDOR. GitHub: https://github.com/omar2535/GraphQLer
- [Safe Browsing](https://thaomar.com/projects/safe-browsing/): Chrome extension that scans websites in real time and gives an instant risk verdict (Safe/Suspicious/Malicious) with phishing and typosquatting detection. Chrome Web Store: https://chromewebstore.google.com/detail/safe-browsing/gddfnfndmpecobmliekmbilogippdnkh
- [reBOOT Canada — Donation Management Platform](https://thaomar.com/projects/reboot/): Full-stack donation management web app for reBOOT Canada. Features CRA-compliant tax receipt generation, donor data management, analytics dashboards, team permission controls, and email alerts.

## Research Interests

- **API Security & Fuzzing**: Automated vulnerability discovery in GraphQL and REST APIs — dependency-aware fuzzing, IDOR detection, and the limits of static vs. dynamic analysis.
- **LLM-Assisted Security Testing**: Using large language models to improve test coverage, classify endpoints, and reason about access-control chains.
- **AI-Powered Cyber Defence**: Using AI systems to detect, respond to, and anticipate attacks in real time — anomaly detection, autonomous incident response, and adaptive threat modelling.
- **Zero Trust Architecture**: Practical implementation of zero trust principles in enterprise environments.