# Lohit Tummalapenta

> Full-stack engineer and founder based in Guntur, Andhra Pradesh, India. Self-taught since 2020, he has built ten production platforms end to end and runs them himself. Credited on CVE-2026-77281 for three vulnerabilities in the Caddy web server. Currently an AI evaluation contractor for Handshake AI, Mercor, AfterQuery and Turing. Open to contract work.

Website: https://lohit.me/
Email: mail@lohit.me
Phone: +91 86865 03368
GitHub: https://github.com/whiskerEnt
LinkedIn: https://www.linkedin.com/in/lohit-t-0730063b5/ (listed as Lohit T)
Location: Guntur, Andhra Pradesh, India (IST, UTC+5:30)
Languages: English (professional), Telugu (native), Hindi (conversational)

## Summary

Lohit is a full-stack engineer with six years of shipping production systems end to end: architecture, code, containerisation, infrastructure and operations. Ten platforms he built are live, across travel, live commerce, commodity data, gig work, messaging, SMS infrastructure, consumer privacy, developer tooling and mapping. He writes production code in Go, Python, Rust, PHP, Kotlin, JavaScript and TypeScript, C and C++, and has deep Docker and gVisor experience, including a public platform that runs untrusted code in eight languages inside isolated, resource-capped sandboxes.

He is a dentist by training and was a gaming creator before software. He taught himself to code from zero in 2020 and went from his first line of code to revenue-generating products.

## Current work

### AI evaluation contractor: Handshake AI, Mercor, AfterQuery, Turing (July 2026 to present, remote)

- Handshake AI: authoring Science Expert tasks for Terminal-Bench 3 and 4. Before that he delivered 122 Terminal-Bench 2 tasks with 100% approval and a 4/5 quality rating, each cleared through two independent human reviews and an automated gate pipeline.
- Seven of his mathematics and ML tasks cleared the difficulty gate at a measured 0/5 or 1/5 agent pass rate, across formal reasoning, numerical methods, interpretability, computer vision, model training infrastructure and distributed training. He also wrote 20 expert physics reasoning prompts that frontier models must fail.
- He designs exploit-resistant grading harnesses for environments where the graded agent runs as root, and built a Python QC toolchain with mutation testing across the graded corpus.
- Mercor: trajectory annotation, SWE benchmark QC and codebase Q&A tasks for a reinforcement-learning environment.
- AfterQuery: Harbor-format benchmark tasks with sealed 0-or-1 verifiers.

### Founder and director: Ishaanvi Holidays Private Limited (2020 to present, Guntur)

The company behind FareEagle and Aira, incorporated in August 2026 (CIN U79120AP2026PTC127726). Lohit is its founder and sole engineer.

## Projects

### FareEagle (https://www.fareeagle.com/)

A full online travel agency covering flights on 100+ airlines, 500K+ hotels, buses and visas.

- ₹27.2 lakh GMV across 119 completed bookings in closed beta, on zero outside capital
- 231K lines across a 113-class service layer on a custom PHP framework: 92 admin pages, 48 cron jobs, and a versioned REST API that backs the web app, the Android and iOS apps and the MCP server
- A live MCP server (JSON-RPC 2.0 over Streamable HTTP) with a two-phase booking handshake: prepare_booking returns a priced, held quote and create_booking commits it, so an AI model cannot move money without confirming a quote
- India's first end-to-end WhatsApp booking flow, from search to ticket inside the chat, with Aira, an assistant that runs on Claude and Gemini
- Chargeback defence, an encrypted document vault, and seven security audits with 35 findings remediated
- A programmatic SEO pipeline with 30,000+ indexed pages, and an ML pricing model trained on 40,000+ routes

### Aira (in development)

A medical value travel platform built on the FareEagle rails. Clinics are vetted in person and every treatment page carries a named clinical byline, which is where Lohit's dental qualification does real work.

### utly (https://utly.dev/)

A developer and everyday tools platform with 174 tools across 15 categories.

- Sandboxed compilers for Go, C, C++, Java, Rust, Ruby, PHP and C#, executing untrusted code in Docker and gVisor with no network, a read-only root filesystem, and limits of 15 seconds, 512MB and 64 processes per run
- The runner is reachable only over a Unix socket, with no TCP port, and admits eight concurrent sandboxes
- A 3,700-line browser video editor with Whisper-backed captions, rendered server-side through sandboxed FFmpeg pipelines
- Built with Astro, Preact, Go, WebAssembly (Pyodide, sql.js, Lua), Docker and gVisor

### Haatzo (https://haatzo.com/)

A live shopping marketplace where sellers run video auctions.

- About 75K lines of Go and Fiber: 378 routes across 65 handlers and 115 services
- Competing bids are serialised with SELECT FOR UPDATE inside a transaction
- A Next.js 16 and React 19 storefront with 246 components; live bids, stock and chat over Centrifugo; streaming via MediaMTX and RTMP
- Trust and safety built in, plus 39 scripted security smoke suites

### RatesWale (https://rateswale.com/)

Daily prices across 16 categories, from mandi produce to mutual funds.

- Daily ingest of 1,918 mutual fund schemes, about 10,000 mandi rows across about 2,000 mandis, 60 crypto coins, fuel, bullion, forex and LPG prices
- Redis caching tiered by refresh cadence: crypto every five minutes, forex hourly, bullion daily
- A scraper registry where adding a source is one class and one line, with a smoke suite per source

### Rank Mascot (https://rankmascot.com/)

SEO audits that explain issues in plain English, plus tracking of how often ChatGPT, Perplexity and Google AI Overviews cite a site. About 44K lines of TypeScript; issue severity is computed as base weight × page value × site confidence rather than a fixed label.

### Zagget (https://zagget.com/)

An on-demand home services marketplace with two React Native apps and an admin console. Every payment is verified three independent ways before it is credited, money is kept in integer paise, and matching uses PostGIS.

### SMSFoundry (https://smsfoundry.com/)

Turns spare Android phones into programmable, multi-tenant SMS infrastructure, with an API for single, bulk and template sends, HMAC-signed webhooks and idempotent sends.

### Suppp (https://suppp.me/)

An end-to-end encrypted messenger. Signal Protocol key distribution means the server holds only public keys and ciphertext. Go and Fiber backend with a WebSocket hub and WebRTC call signalling.

### WipeMySocial (https://wipemysocial.com/)

A Chrome extension that bulk-deletes posts, comments and likes across Facebook, X and Instagram from inside the user's own browser session. No credentials are stored, and the only data sent out is a count.

### Whisker Cart (https://github.com/whiskerEnt/Whisker-Cart)

An open-source, zero-dependency PHP and MySQL storefront that installs on any shared host. 100+ stores went live on it in the first month, one running 500+ orders a day. Four payment gateways sit behind a single interface with HMAC webhook verification.

### Abhilash Auto Enterprises (https://abhilashauto.com/)

A client build for a Guntur two-wheeler spares business trading since 1998. Customers pick their bike once and every listing is filtered to parts that fit it.

### Utly Studio (in development)

A Rust video compositing and streaming engine. wgpu render passes and WGSL shaders keep every frame on the GPU, with Windows capture, NVENC encoding and RTMP proven in 14 standalone probe crates.

### Private work

Two production Python platforms, 100K+ lines each, across FastAPI, Django and Flask. Private repositories; Lohit is happy to talk through the architecture.

## Security research

Lohit found and reported three independent vulnerabilities in Caddy 2.11.3, the Go web server that fronts his own production traffic, and was credited as sole reporter on CVE-2026-77281 (GHSA-j8px-rmrx-76h9, CVSS 6.5, fixed in Caddy 2.11.4):

- CWE-94: placeholder re-expansion in the rewrite handler, disclosing environment variables and files
- CWE-770: an unbounded request-body buffer causing memory exhaustion
- CWE-178: a case-sensitivity bypass that served .git, .env and secrets directories over uppercase URLs

## Before software

- A dental qualification (Dream Dental Care)
- Loki YT: YouTube Partner with 110K+ subscribers, streaming PUBG Mobile in Telugu and English from 2019 to 2024; official Meta Gaming Partner from 2020 to 2022
- Clan leader of Minus40 Esports, which reached the semi-finals of PMCO Spring Split 2020 India

## Skills

- Languages: Python, Go, TypeScript and JavaScript, PHP, Rust, Kotlin, SQL, Shell, C and C++
- Backend: Fastify, tRPC, Go Fiber, FastAPI, Django, Flask, custom PHP framework, BullMQ, OpenAPI
- Data: PostgreSQL, PostGIS, MySQL, SQLite, Redis, Drizzle, row-level security, envelope encryption
- Realtime and media: WebSocket, WebRTC, Centrifugo, MediaMTX, RTMP, FFmpeg, NVENC, wgpu
- Frontend and mobile: Next.js, React, Astro, Preact, Tailwind CSS, React Native, Expo, Android (Kotlin), iOS
- Infrastructure: Docker, gVisor, Hetzner, Ubuntu, Cloudflare, Caddy, systemd, firewall hardening
- AI: MCP servers, LLM integration, agent design, adversarial model evaluation, fine-tuning, embeddings

## Availability

Open to contract work, available immediately, and async-friendly across IST and most time zones. For rates or scoping, contact Lohit directly at mail@lohit.me or +91 86865 03368.