Ziyad Mansy Applying to CS PhD programs for Fall 2027

Ziyad Mansy

Independent researcher in software testing and security, and senior mobile software engineer. I build automated testing that finds bugs and security flaws before software ships — especially silent failures that give wrong results without crashing.

3sole-authored papers under review at ICST, AST and FORGE 2027
18M+monthly downloads of the two Google libraries my findings reached
5+ yrsshipping production apps · 200K+ downloads
1stof ~200 in my 2022 graduating cohort

About

I work on automated testing that finds bugs and security vulnerabilities before software ships — especially silent failures that give wrong results without crashing — and that reports real problems, not false alarms.

In 2026 I wrote three sole-authored studies on LLM-guided fuzzing, now under review. The work uncovered silent data loss in two Google libraries with 18M+ downloads a month combined; both maintainers documented the behavior, and my documentation fix was merged into json_serializable.

Before research, I spent five years shipping iOS, Android and web apps for US, UK, Saudi and UAE clients. At a buy-now-pay-later platform licensed by the Saudi Central Bank, I closed every finding from each recurring penetration test, with zero production security incidents. Today I build HIPAA-compliant medical-transportation apps for a US company.

Methods Fuzzing, security testing, program analysis, LLM testing agents and the knowledge they need, test oracles, differential and metamorphic testing, empirical studies.

Areas Mobile, web and cross-platform app security, AI-generated code and LLM agents, untrusted input handling, library updates and software supply chains.

News

Publications

Three sole-authored papers under review at ICST, AST and FORGE (the latter two co-located with ICSE 2027). Each comes with a preprint, code and data, and an archived software DOI.

[P3] · ICST 2027 · Under review

Where Does an LLM Fuzzer's Domain Knowledge Come From? Human, Code-Read, and Self-Acquired Knowledge for Differential Testing of Typed Deserializers

IEEE International Conference on Software Testing, Verification and Validation

A pre-registered study of 8 JSON libraries in Dart and Kotlin (55 seeded runs, 83,500 inputs) comparing knowledge written by a person, read from code, or learned from the agent's own experiments. Human-written knowledge worked best (30.9% vs. 1.5% of inputs exposing disagreements without it); the experimenting agent raised Kotlin's rate from 50% to 67% but missed rare failures.

Preprint →Code & data →Software DOI →

[P2] · AST 2027 · Under review

Beyond Sanitizers: LLM-Guided Refinement for Differential JSON Deserialization Testing in Dart

ACM/IEEE International Conference on Automation of Software Test

Found silent data errors in 5.7% of 43,336 checks by comparing four common ways to decode JSON in Dart against the original text. The LLM fuzzer first trailed a simple generator (2.9% vs. 22.2%); four facts about the libraries raised it to 28.8%.

Preprint →Code & data →Software DOI →

[P1] · FORGE 2027 · Under review

Coverage-Free Fuzzing: LLM-Guided Refinement of Grammar-Based Test Generators

International Conference on AI Foundation Models and Software Engineering

An LLM improves a grammar-based test generator using only how the target responds from outside, never its code; every LLM-written change runs in a sandbox first. Raised valid inputs on cJSON from 58% to 97%; a pre-registered replication on a second parser showed where the approach fails.

Preprint →Code & data →Software DOI →

Research experience

2026 – Present

Independent Researcher, LLM-Guided Software Testing

Began with a fuzzing challenge Dr. Marcelo d'Amorim (NC State) set for prospective PhD applicants, then continued independently into three studies, each answering a question the previous one raised. Uncovered silent data loss in Google's json_serializable and built_value, now documented.

2021 – 2022

Undergraduate Researcher, Breast Tumor Classification

Modern Academy for Engineering and Technology · Advisor: Dr. Manar Donia

Trained a TensorFlow transfer-learning classifier on 5,000+ breast-tumor scans with OpenCV preprocessing, and deployed it on-device with TensorFlow Lite in a Flutter app that works fully offline.

Research software

  • Coverage-free fuzzing framework (Python, C; DOI) — turns a grammar into a test generator, refines it with an LLM and runs it on C parsers with memory-error detectors; released with a 20-test suite and logs of all 87,060 executions.
  • Dart differential-testing harness (Dart, Python; DOI) — four Dart deserialization paths checked by two automatic oracles; every reported table recomputes from the released data.
  • Kotlin harness and knowledge-acquisition agents (Kotlin, Python; DOI) — four JSON libraries, code-reading and probing agents, 49 automated tests, and every prompt and result of 55 seeded runs.

Open source and upstream impact

  • Google json_serializable — found that it silently caps out-of-range integers and turns 1.9 into 1; the maintainer confirmed it and merged my docs fix (#1591, PR #1592).
  • Google built_value — reported that a missing required list silently becomes empty; the maintainer documented it upstream (#1404, dart-lang/build#5178).
  • JetBrains kotlinx.serialization — reported, with a standalone reproducer, that strict mode accepts control characters the JSON standard forbids (#3276).
  • intercom_flutter — fixed an app crash at startup on recent iOS versions in a package with 320K+ monthly downloads; released in v9.0.4 (PR #431).
  • LLVM — isolated an AddressSanitizer hang on macOS and showed LLVM 23.1.0 unaffected (#200447).
  • Community — 3,000+ GitHub contributions in 50+ repositories; Stack Overflow top 8% (2021); articles on Medium.

Industry experience

5+ years shipping production iOS, Android and web apps for US, UK, Saudi and UAE clients — 200K+ downloads.

May 2026 – PresentRemote · US

Senior Mobile Software Engineer

Naveera Tech · App Store · Google Play

  • Took over a fleet-operations platform that had gone 9 months without a release and shipped it to both stores within one month of joining; it now handles thousands of trips a day for hundreds of US client organizations.
  • Built HIPAA-compliant medical-transportation apps with an offline-first architecture that keeps dispatch, navigation and trip state correct through connectivity loss.
  • Owned testing end to end: unit and integration tests, manual passes, and AI agents running manual-style scenarios across core flows.
Aug 2024 – Apr 2026Remote · UK

Senior Mobile Software Engineer

Focal Agent · Web · App Store · Google Play

  • Delivered AI features for PropertyBox, a real-estate platform used by agencies across the UK, Europe and the UAE, including enterprise clients Reapit and Connells: automated property descriptions, AI photo enhancement and one-step social publishing.
  • Wrote unit and integration tests and automated manual testing with AI agents that use the app like a human tester.
Jan 2023 – Jul 2024Remote · Saudi Arabia

Lead Mobile Software Engineer

Madfu (BNPL fintech) · App Store · Google Play

  • Hired to replace separate native Android and iOS apps with a single Flutter app built from scratch.
  • Led 3 senior Flutter engineers and owned the architecture and delivery of the consumer and merchant POS apps (100K+ downloads) of a platform licensed by the Saudi Central Bank (SAMA).
  • Kept zero production security incidents by closing all 5–10 findings from each recurring third-party penetration test.
  • Built the team's quality process from nothing: mandatory code review, a shared component library and test-driven development.
Jan 2022 – Dec 2022Remote · Saudi Arabia

Senior Mobile Software Engineer

Assas IT Solutions · App Store · Google Play

  • Built core features of Tahara, a women's-health app that reached #2 in Health & Fitness on the Saudi App Store, with 100K+ downloads and a 4.7/5 rating from 1.2K+ reviews.
Mar 2021 – Dec 2021Remote · UAE

Founding Mobile Software Engineer

Talmaro · App Store · Google Play · AppGallery

  • Built and shipped Talmaro-ESS from scratch as the company's first mobile engineer, an enterprise HR app that reached 10K+ downloads across three stores.
Self-published

Independent App Developer

Google Play

  • Designed, built and published 5 apps as sole developer, including a Flutter app in 9 languages (1K+ downloads, 4.9/5) and four native Android apps in Java and Kotlin.

Leadership and teaching

  • AI-assisted development — ran recurring online sessions at Focal Agent training engineers on AI coding tools.
  • Engineering mentorship — mentored junior Flutter engineers at Assas through Tahara's path to production, and the 3 senior engineers I led at Madfu.
  • Graduation project team leader — led the team to an A+, planned the work, taught teammates and was the advisor's point of contact.
  • Peer study guides — wrote a study guide for every course before each final exam; my cohort relied on them to prepare.
  • Presentations — led my team's seminar presentations (Seminar I: A+) and presented our graduation project at its final defense before a committee with external examiners.

Education

B.Sc. in Engineering and Technology, Electrical Engineering (Computer Engineering and IT Branch)

Modern Academy for Engineering and Technology, Cairo · May 2022

  • Ranked 1st of ~200 in cohort · General grade: Excellent · CGPA 3.535/4.00 (90.03%) · First-year GPA 3.97/4.00.
  • WES U.S. equivalency: Bachelor's degree, GPA 3.71/4.00 (course-by-course evaluation, 180 semester credits).
  • Graduation project: Modern Home Furniture in Virtual Reality (grade A+, team leader; advisor: Prof. Abdelmoneim Fouda) — an AR app (Flutter, Unity3D, Google ARCore) placing furniture in a real room at real scale.
  • Selected coursework: Data Structures & Algorithms · Software Engineering · Languages & Compilers · Distributed Computer Systems · Computer Modeling & Simulation · Probability & Statistics.

Honors and selections

  • Ranked 1st of ~200 in the 2022 graduating cohort.
  • Selected for a Q&A session with Dr. Marcelo d'Amorim (NC State) — one of ~20 of ~70 prospective PhD applicants whose solutions to his research challenge passed (2026).

Skills

Research & testing

Fuzzing, grammar-based and property-based test generation, differential testing, automated test generation, static analysis, TDD, pre-registered experiments, exact nonparametric statistics (Mann–Whitney U, Cliff's δ, Holm correction).

Tools

Hypothesis, ANTLR, AddressSanitizer, UndefinedBehaviorSanitizer, OpenAI API, Git, GitHub Actions, Azure DevOps, Codemagic.

Programming languages

Dart, Python, Kotlin, C, Java, Swift, JavaScript.

Mobile & web

Flutter, Android, iOS, React, Flutter Web; Clean Architecture, SOLID, offline-first systems; secure key storage, encryption at rest.

Apps

Apps I build and publish myself on Google Play.

Piety of Hearts

Prayer times, Quran, Qibla, Azkar, Tasbih and Adhan, in 9 languages. Built in Flutter. Rated 4.9.

View on Play →

Wesal Calculator

A focused pricing calculator — simple, fast and practical.

View on Play →

BOBA Colors

A relaxing, playful coloring game. Rated 5.0.

View on Play →

Flying Bird

A simple, relaxing arcade game. Rated 5.0.

View on Play →

Writing

Notes on the road from Egypt to a PhD abroad — research, applications, and life overseas.

New posts coming soon. Older articles are on Medium; follow along on X or LinkedIn.

Get in touch

For PhD opportunities, research collaboration, or just to say hello.

ziyadmohammad37@gmail.com