DEV Community: Aman Bhawsar

Most site owners find out their security is broken the hard way — after a breach, not before. 🔒

Aman Bhawsar — Wed, 23 Sep 2026 10:13:01 +0000

Built GuardHawk — a one-click website security audit tool. Point it at any domain you own or manage, get a full report back in seconds: no login, no agent installed, nothing invasive — just reads what's already publicly checkable (the same way a browser or a certificate authority would).

What it checks, all in one run:
✅ SSL/TLS certificate (valid, expiry, issuer)
✅ DNS records + DNSSEC
✅ Email security — SPF, DKIM, DMARC (is your domain spoofable by phishers?)
✅ Security headers (HSTS, CSP, Permissions-Policy…)
✅ Subdomain-takeover risk (a dangling DNS record pointing to a service you don't control anymore — a real, common way domains get hijacked)
✅ Public cloud-storage exposure (accidentally public S3 buckets)
✅ Tech stack, WHOIS, blacklist status
✅ A 0-100 health score + a plain-English fix list

Real example — ran it just now:

I ran GuardHawk against github.com:

🔗 github.com — 94/100 (Grade A)

✅ SSL/TLS checked
✅ SPF, DKIM & DMARC checked
✅ Security headers checked
✅ No subdomain takeover risk detected
✅ No public cloud buckets detected
✅ Blacklist status checked
⚡ Response time: 72 ms

It still identified 2 issues worth reviewing:
⚠️ Permissions-Policy header missing
⚠️ DNSSEC not enabled

That's exactly what GuardHawk is built for — giving you a quick view of what is configured correctly and what still needs attention. Even a site the size of GitHub has fixable gaps — nobody's perfect, you just need to actually see the list.

Where this fits:
🔧 Agencies & MSPs auditing client sites before onboarding
🤖 Drop it into an n8n workflow for scheduled security monitoring across a whole portfolio of domains
🔗 Runs on Apify — one domain or bulk-audit hundreds, no API key needed

🔗 apify.com/inexhaustible_glass/domain-health-audit

What's the last security gap you found on a "trusted" site? 👇

GovCon Intelligence — an agent that can't answer without real structured data

Aman Bhawsar — Sun, 20 Sep 2026 11:20:47 +0000

This is a submission for the Sanity Challenge, Path One: Ship an Agent That Queries Real Content

What I Built

GovCon Intelligence — an agent that answers real questions about US
federal contractors (who works with which agency, how much they've been
paid, whether they're growing or shrinking) by querying a live, structured
Sanity dataset through Sanity Context MCP. Not a summary of documents — a
real relational query over contractor documents that reference
agency documents.

The brief was blunt: "if a keyword search would have gotten you the same
answer, aim higher." So the question I asked myself building this was: what
can I ask that a flat-text search genuinely cannot answer?

"Which contractors work with the Department of Defense and are not
decreasing in growth?"

That's a join, not a lookup. It needs to filter contractors by a boolean on
their own field (growthTrend != "decreasing") and by whether any of
their referenced agency documents has a specific name. No amount of
full-text search over a JSON blob gets you that. Real result, from real
data, first try:

Contractor	DoD amount	Growth
Booz Allen Hamilton	$42.9B	stable
Accenture Federal Services	$7.54B	stable
Deloitte Consulting	$7.16B	stable

The data is real, not a fixture: I pulled it live from my own
Federal Contractor Intelligence
Apify actor, which queries USAspending.gov directly, and pushed the output
into Sanity as contractor/agency documents with genuine references
(not flattened strings). Lockheed Martin's $622B lifetime value in the demo
is a real US government spending record.

Demo

Live, no login, no setup: https://govcon-intelligence-seven.vercel.app

Try asking:

"Who has the highest lifetime contract value?"
"Show me contractors with a declining growth trend"
"Which contractors work with NASA?"

Every answer is a live groq_query call against the real dataset — nothing
is canned. The demo runs on a free-tier LLM key (NVIDIA, openai/gpt-oss-20b,
no card required) so anyone judging this can run it without paying for
anything, and it's rate-limited to 15 questions/hour/IP to keep that key
usable for everyone.

Code

Repo is private (I keep all my repos private as a personal practice), so
here's the core of it directly — the whole agent loop is deliberately small:

# agent.py — the loop: ask the LLM, let it call groq_query on the live
# MCP endpoint, feed the real result back, repeat until it has an answer.
def ask(question):
    messages = [{"role": "system", "content": SYSTEM_PROMPT},
                {"role": "user", "content": question}]
    for i in range(6):
        msg = llm_call_openai_format(messages, allow_tools=(i < 5))
        messages.append(msg)
        tool_calls = msg.get("tool_calls")
        if not tool_calls:
            cleaned = _clean(msg.get("content"))
            if cleaned:
                return cleaned
            break
        for tc in tool_calls:
            args = json.loads(tc["function"]["arguments"])
            mcp_result = mcp_call("tools/call",
                                   {"name": "groq_query", "arguments": args})
            tool_text = mcp_result["result"]["content"][0]["text"]
            messages.append({"role": "tool", "tool_call_id": tc["id"],
                              "content": tool_text})
    # Forced final answer, tools off — "no match" is a valid, honest answer
    messages.append({"role": "user", "content":
        "Based only on the query results above, give your final answer now."})
    final = llm_call_openai_format(messages, allow_tools=False)
    return _clean(final.get("content")) or "No matching contractors found."

# mcp_call — talks to the real Sanity Context MCP endpoint over HTTP
def mcp_call(method, params):
    body = json.dumps({"jsonrpc": "2.0", "id": 1, "method": method,
                        "params": params}).encode()
    req = urllib.request.Request(
        SANITY_MCP_URL, data=body, method="POST",
        headers={"Authorization": f"Bearer {SANITY_ORG_TOKEN}",
                 "Content-Type": "application/json",
                 "Accept": "application/json, text/event-stream"})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.loads(r.read())

Flask serves a small dark-themed chat UI in front of it (live stats bar,
markdown tables, source citation on every answer) — deployed on Vercel.

How I Used Sanity

Schema is two document types, deliberately kept small so the reference
relationship is the whole point:

// contractor: name, uei, totalLifetimeValue, growthTrend, leadScore,
// exclusionStatus, and topAgencies[] — an array of
// { agency: reference -> agency, amount: number }
//
// agency: name, isDoD

I pointed Sanity Context at my own Sanity dataset (GROQ mode, not a
crawled Knowledge Base — the content already lives in Sanity as real
documents, so there was nothing to crawl) and created an MCP endpoint scoped
to _type in ["contractor", "agency"]. The agent calls two of the tools
Context exposes: initial_context (to learn the schema on first turn) and
groq_query (to actually answer). The system prompt is explicit that it may
only state numbers the tool returned — never estimate.

Three things broke on the way that are worth being honest about:

Sanity Context requires a deployed Studio app, not just a deployed schema — I hit a hard -32004 error until I ran sanity deploy against a Studio actually built on sanity@6 (my first template was v3, which doesn't qualify).
The model I originally wired had been retired from NVIDIA's catalog since I last used it — found the current one by checking the live /v1/models list instead of guessing.
gpt-oss's harmony format occasionally leaked an internal commentary to=functions... fragment into the answer instead of using the structured tool_calls field, and separately could burn all its tool-call turns chasing a genuinely-empty result. Fixed both at the agent layer rather than papering over them in the UI — see the _clean() strip and the forced tools-off final turn in the code above.

Sanity Project Details

Project ID: 6t5rf0s6, dataset production.
MCP endpoint name: govcon-intelligence-agent (GROQ mode).

Agent Session

(Optional — will add a curated Claude Code session transcript via the DEV agent-session uploader before publishing, and remember to hit "Make Public.")

Passion Profiler — an AI that scores and speaks what a YouTuber truly loves

Aman Bhawsar — Fri, 10 Jul 2026 10:09:44 +0000

This is a submission for Weekend Challenge: Passion Edition

What I Built

Passion Profiler turns any YouTube creator's channel into an AI "passion portrait" — a scored, quoted, and spoken tribute to what they truly care about.

The theme is passion, and nothing shows a person's passion better than hours of their own words spoken straight to camera. So I built a tool that reads those words and reflects the passion back.

Point it at a channel and it:

Pulls the transcripts of their recent videos.
Sends them to Google Gemini, which uncovers what the creator is deeply passionate about — their obsessions, a Passion Score (0–100), and their most fired-up quotes.
Writes a heartfelt fan tribute and speaks it aloud with ElevenLabs.
Renders it into a shareable HTML "passion portrait."

Real example — Veritasium, from 6 videos:

Passion Score: 95/100 — "A relentless detective of the physical world, driven by the wonder of discovery and the moral imperative of empirical truth."
🔥 The scientific method as a moral compass · The elegance of algorithmic thinking · Unsolved mathematical mysteries
💬 "That is not science. That is not justice."

Demo

A "passion portrait" for Veritasium (Passion Score 95/100), with the tribute voiced by ElevenLabs:

Code

Amanbhaw / passion-profiler

Turn any YouTube creator's channel into an AI 'passion portrait' — scored, quoted, and spoken. Gemini + ElevenLabs, free tiers. DEV Weekend Challenge.

❤️‍🔥 Passion Profiler

Turn any YouTube creator's channel into an AI "passion portrait" — a scored quoted, and spoken tribute to what they truly love.

Point it at a channel. It reads their actual words (transcripts), figures out what fires them up, scores how passionately they speak, pulls their most electric quotes, writes them a heartfelt tribute, reads that tribute aloud and drops the whole thing into a single shareable HTML page.

Built for the DEV Weekend Challenge — Passion Edition. Runs entirely on free tiers.

Try it in 60 seconds (no API key)

git clone https://github.com/Amanbhaw/passion-profiler.git
cd passion-profiler && pip install -r requirements.txt
python passion_profiler.py --self-test

--self-test really runs the engine: it fetches a live YouTube transcript through WARP, synthesizes a voice clip, and renders an HTML portrait — proving every stage works before you add any key. Then add one LLM key (below) and point…

View on GitHub

How I Built It

Python, one file, three stages — each with a free path.

1. Getting transcripts is the hard part. YouTube blocks datacenter IPs, so yt-dlp from a server gets "Sign in to confirm you're not a bot." I solved it with a bundled, self-contained Cloudflare WARP userspace proxy (warp.py): it registers an anonymous WARP credential and runs wireproxy so traffic exits from Cloudflare's IP pool — no account, no root, and it works inside Docker with a plain docker run. If a video has no captions, it downloads the audio and transcribes it locally with Whisper — so every video is covered.

2. The passion analysis is a single Google Gemini call returning strict JSON (headline, passion score, passions with evidence, fire quotes, tribute). The LLM layer is pluggable — Gemini, local Gemma, Groq, NVIDIA, OpenAI, Claude, Mistral all auto-detect, and a --check command verifies your setup.

3. Voice is ElevenLabs (eleven_multilingual_v2), with a free Edge-TTS fallback so it never hard-fails.

The whole thing runs on free tiers, auto-loads .env, and ships a --self-test that proves every stage with no API key.

Prize Categories

Best use of Google AI — Gemini does the entire passion analysis, reading transcripts and returning structured insight plus the tribute.
Best use of ElevenLabs — the tribute isn't just text; ElevenLabs voices it, turning a paragraph into something that feels like a heartfelt message.

Built with love for creators who pour themselves into their work.

Turn Public Business Loan Records (UCC Filings) Into B2B Leads with an API

Aman Bhawsar — Thu, 09 Jul 2026 16:00:42 +0000

Here's a lead source most people overlook: UCC filings.

Every time a business takes a secured loan — equipment financing, a line of credit, working capital — a UCC filing becomes public record. It tells you the borrower, the lender, and what was financed. If you sell to businesses that borrow money, these are some of the warmest B2B leads out there.

The catch: this data is scattered across state filing offices in messy formats.

The easy way

I built a scraper that pulls multi-state UCC filings into clean JSON/CSV — no manual lookups.

What you get per filing:

Debtor (the business) — name & address
Secured party (the lender)
Filing date, collateral, and status
Multi-state coverage in a single run

Example output


json
{
  "debtor_name": "Riverside Logistics Inc",
  "secured_party": "First Capital Bank",
  "collateral": "Equipment",
  "filing_date": "2026-06-30",
  "status": "Active"
}

Try it

👉 US UCC Filings Scraper:
https://apify.com/inexhaustible_glass/ucc-filings-scraper

See all my scrapers:
https://apify.com/inexhaustible_glass

Perfect for lenders, MCA brokers, equipment finance, and B2B sales teams targeting companies that are actively spending.

What public dataset should I turn into an API next? Let me know 👇

How to Get Fresh New-Business Leads Across 6 US States (with a simple API)

Aman Bhawsar — Thu, 09 Jul 2026 05:57:02 +0000

Every day, thousands of new companies register across the US — and new businesses buy everything: banking, insurance, software, accounting. If you sell B2B, reaching them in their first week is a huge advantage.

The problem: business registries are split across dozens of state websites, each with its own format. Scraping them yourself is painful.

The easy way

I built a scraper that pulls newly registered businesses across 6 US states (14M+ records) into clean JSON/CSV — no setup, no browser automation on your side.

What you get per company:

Company name, registered agent, address
Registration date & status
Cross-linked with SEC EDGAR + OFAC sanctions screening

Example output


json
{
  "company_name": "Sunrise Ventures LLC",
  "state": "TX",
  "status": "Active",
  "registered_agent": "John Smith",
  "registration_date": "2026-06-28"
}

Try it

👉 US Business Registry Scraper:
https://apify.com/inexhaustible_glass/us-business-registry

See all my scrapers here:
https://apify.com/inexhaustible_glass

Free to try. Great for B2B sales, fintech onboarding, and compliance teams who want first-mover advantage on fresh leads.

What data source would you want scraped next? Drop a comment 👇