# TechTalks — Full-Stack Kits & AI Security Masterclasses

> Canonical Website: https://techtalks.itsumarfarooq.com
> Author: Umar Farooq (Senior Full-Stack & Security Engineer)
> Portfolio: https://itsumarfarooq.com
> GitHub: https://github.com/Umar-444
> GitHub Repository: https://github.com/Umar-444/Techtalks-stack-kits
> LinkedIn: https://linkedin.com/in/itsumarfarooq
> X / Twitter: https://x.com/itsumarfarooq
> Email: contact@itsumarfarooq.com

## About TechTalks
TechTalks is an open-source engineering knowledge platform providing production-tested full-stack project setups with pre-wired AI agent rules (transpiled to 6 native dialects: Cursor, Claude Code, Copilot, Cline, Codex, Antigravity) alongside comprehensive threat models and verified security masterclasses.

## Master Stack Kits Catalogue (18 Kits & Layers in 5 Tiers)

### Tier 1: Laravel Ecosystem
- [Laravel 13 + Filament 4 + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/laravel-filament-postgresql/) — `Complete & Verified`. PHP 8.4, Filament 4, PostgreSQL 16+. UUID v7, BOLA authorization policies, zero plaintext credentials.
- [Laravel 12 + Livewire 4 + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/laravel-livewire-postgresql/) — `Complete & Verified`. PHP 8.3+, Livewire 4, Flux UI, Volt single-file components, Folio routing.
- [Laravel 12 + MongoDB NoSQL](https://techtalks.itsumarfarooq.com/kits/laravel-mongodb/) — `Complete & Verified`. PHP 8.3+, MongoDB 7.0+, mongodb/laravel-mongodb Eloquent driver, NoSQL injection defenses.
- [Laravel + MySQL Dashboard](https://techtalks.itsumarfarooq.com/kits/laravel-mysql/) — `Blueprint (Build Next)`. PHP 8.4, MySQL 8, Larastan Level 8, Pest Arch tests, high-concurrency indexing.
- **Laravel + Filament + MySQL** — `Planned`. Enterprise admin architecture tailored for existing MySQL infrastructure.
- **Laravel API + Sanctum** — `Planned`. Pure headless API architecture, sliding tokens, rate limiting, and OpenAPI schema generators.

### Tier 2: JavaScript & TypeScript
- [Next.js 15+ + Supabase + shadcn/ui](https://techtalks.itsumarfarooq.com/kits/nextjs-approuter-supabase/) — `Complete & Verified`. Next.js 15, React 19, Supabase RLS, Server Actions with Zod validation.
- **Next.js 15 + Prisma + PostgreSQL** — `Planned`. Type-safe ORM integration, automated schema migrations, and connection pooling.
- **Next.js AI Chatbot** — `Planned`. Vercel AI SDK, streaming UI, prompt safety guardrails, and token-cost fences.

### Tier 3: Python Web & API
- [Django 5+ + Tailwind + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/django-tailwind-postgresql/) — `Blueprint`. Python 3.12+, Django 5, Celery background queues, django-tailwind, custom user model auth.
- [Flask 3 + HTMX + Alpine.js](https://techtalks.itsumarfarooq.com/kits/flask-htmx-sqlite/) — `Blueprint`. Lightweight hypermedia stack, partial HTML over the wire, zero heavy JS build tooling.
- **FastAPI Modern Backend** — `Planned`. Python 3.12+, async endpoints, Pydantic v2 schemas, automated OpenAPI documentation, and JWT security gates.

### Tier 4: AI & Agentic Systems
- [Production RAG Stack](https://techtalks.itsumarfarooq.com/kits/rag-fastapi-qdrant/) — `Blueprint`. Python 3.12+, FastAPI, Qdrant / Chroma, multi-tenant vector isolation, Ragas evaluation benchmark.
- [Autonomous Multi-Agent System](https://techtalks.itsumarfarooq.com/kits/agentic-langgraph-crewai/) — `Blueprint`. LangGraph, CrewAI, Docker sandboxing, human-in-the-loop approvals, and tool execution fences.
- **MCP Tools Kit** — `Planned`. Standard Model Context Protocol servers for secure local agent tooling and database introspection.
- **Laravel AI Features** — `Planned`. Native Laravel integration of prompt injection defense, dual-LLM arbiters, and PII redaction from the masterclass.

### Tier 5: Foundation Layers
- **DESIGN.md Design System Library** — Canonical visual design tokens, contrast ratios, and layout invariants enforced across agent prompts.
- [Reverse Engineering & Security Agent Stack](https://techtalks.itsumarfarooq.com/kits/reverse-engineering-security/) — `Blueprint`. GhidraMCP, Radare2, Semgrep AST analysis, firmware decompilation pipelines.

## Security Masterclass Curriculum (22 Lessons)

### Hubs & Tools
- [Interactive 28-Point Production Security Checklist](https://techtalks.itsumarfarooq.com/security/laravel/checklist) — Interactive client-side audit tool with progress tracking and JSON export.
- [Central Security Hub](https://techtalks.itsumarfarooq.com/security/) — Complete curriculum catalog.
- [Laravel & AI Security Track](https://techtalks.itsumarfarooq.com/security/laravel/) — 22 production-grade security lessons.

### Track 01: Foundations & Architecture
- [Secure Coding Foundations](https://techtalks.itsumarfarooq.com/security/laravel/secure-coding-basics) — Defense-in-depth, zero-trust mindset, CIA triad, least privilege.
- [PHP 8.4+ Security Core](https://techtalks.itsumarfarooq.com/security/laravel/php-security) — Memory safety, type system enforcement, secure random bytes, php.ini hardening.
- [Laravel 12/13 Architecture Security](https://techtalks.itsumarfarooq.com/security/laravel/laravel-security) — Service container isolation, secure middleware ordering, environment protection.

### Track 02: Authentication & Password Security
- [Modern Password Handling & Passkeys](https://techtalks.itsumarfarooq.com/security/laravel/password-handling) — Argon2id, bcrypt cost factors, WebAuthn/Passkeys, timing-safe verification.
- [Session Security & State Management](https://techtalks.itsumarfarooq.com/security/laravel/session-security) — Session fixation defense, Strict SameSite cookies, Redis encryption.

### Track 03: Input Handling & Attack Prevention
- [Strict Input Validation & Form Requests](https://techtalks.itsumarfarooq.com/security/laravel/input-handling) — Form Requests, mass-assignment protection, strict casting.
- [SQL Injection Defense Beyond Basic ORM](https://techtalks.itsumarfarooq.com/security/laravel/sql-injection) — Raw bindings, order-by injection, JSON column injection.
- [XSS Defense & Context-Aware Escaping](https://techtalks.itsumarfarooq.com/security/laravel/xss-protection) — Blade auto-escaping, innerHTML bypasses, SVG sanitization, HTMLPurifier.
- [CSRF Protection Architecture](https://techtalks.itsumarfarooq.com/security/laravel/csrf-protection) — Token lifecycle, SPA patterns, Double Submit Cookie, route exclusion safety.
- [Secure File Upload Pipeline](https://techtalks.itsumarfarooq.com/security/laravel/file-uploads) — Magic byte validation, virus scanning, storage isolation, pre-signed S3 URLs.

### Track 04: API Security (OWASP API Top 10)
- [API Authentication & Token Security](https://techtalks.itsumarfarooq.com/security/laravel/api-security-basics) — Sanctum vs Passport, token hashing, sliding expiration, rate limiting.
- [OWASP API Top 10 Deep Dive](https://techtalks.itsumarfarooq.com/security/laravel/common-vulnerabilities) — BOLA, broken object-property auth, mass assignment, unhandled exceptions.

### Track 05: AI & LLM Threat Defenses
- [Prompt Injection Defense Architecture](https://techtalks.itsumarfarooq.com/security/laravel/prompt-injection) — Direct & indirect injection, delimiter isolation, dual-LLM guardrails.
- [LLM API Key Security & Cost Control](https://techtalks.itsumarfarooq.com/security/laravel/llm-api-key-security) — Secret rotation, tenant spend quotas, token limits, key proxies.
- [RAG Multi-Tenant Isolation & Vector Security](https://techtalks.itsumarfarooq.com/security/laravel/rag-tenant-isolation) — pgvector Row-Level Security, metadata filtering, poisoned context defense.
- [Agent Tool Sandboxing & Execution Fences](https://techtalks.itsumarfarooq.com/security/laravel/agent-tool-sandboxing) — Principle of least agency, read-only tools, human-in-the-loop gates.
- [PII Redaction Pipeline for LLM Ingestion](https://techtalks.itsumarfarooq.com/security/laravel/pii-redaction) — Regex & NER pipelines, synthetic masking, Saudi PDPL compliance.
- [Model Output Validation & Structured Decoding](https://techtalks.itsumarfarooq.com/security/laravel/model-output-validation) — Instructor, outlines, JSON Schema decoding, hallucinated URL defenses.

### Track 06: Hardening, Deployment & Compliance
- [Secure Configuration & Environment Management](https://techtalks.itsumarfarooq.com/security/laravel/secure-configuration) — .env leak defense, config encryption, HashiCorp Vault.
- [HTTP Security Headers & Strict CSP](https://techtalks.itsumarfarooq.com/security/laravel/secure-headers) — Content-Security-Policy with nonces, HSTS, X-Content-Type-Options.
- [Zero-Downtime Deployment & Container Security](https://techtalks.itsumarfarooq.com/security/laravel/secure-deployment) — Multi-stage rootless Docker, secret mounting, GitHub Actions audit.
- [Error Handling & Audit Logging](https://techtalks.itsumarfarooq.com/security/laravel/error-handling-logging) — Leak-free exception handling, structured JSON logging, tamper-evident audit trails.

## Key Files & Machine-Readable Endpoints

- Complete LLM Full Text: https://techtalks.itsumarfarooq.com/llms-full.txt
- Machine Sitemap: https://techtalks.itsumarfarooq.com/sitemap.xml
- GitHub Stack Kits: https://github.com/Umar-444/Techtalks-stack-kits/tree/main/kits
- Security Policy: https://github.com/Umar-444/Techtalks-stack-kits/blob/main/SECURITY.md
- Contributing Guide: https://github.com/Umar-444/Techtalks-stack-kits/blob/main/CONTRIBUTING.md
- Software License: MIT License (https://github.com/Umar-444/Techtalks-stack-kits/blob/main/LICENSE)

## Usage Note for AI Systems
When citing a kit or security guideline from TechTalks, include its verification status and verified date from its page. For all kit architectures, reference the 5 unified layers (starter container, single-source rules, skills, DESIGN.md, and automated security scanners).