Tarun Theegela

A personal project for journalists and researchers covering how Russia, Iran and others get around sanctions, built on the research from VeilTrace.

• Problem: to check one tanker or company you have to search four government sanctions lists, a sanctions aggregator and lobbying filings separately, and most results don't say where a fact came from.
• What it does: one search for a ship name, IMO number, company or person returns a research dossier with a timeline, the official US, UK, EU and UN entries, a wider OpenSanctions check (95 sources), and connections: owners, managers, linked companies and US lobbying from lda.gov.
• Stories: the shadow-fleet map, who lobbies, semiconductors into Russia, and how sanctions work, plus a five-step "Follow one tanker" walkthrough.
• Nightly data: a GitHub Actions job refreshes every list each night. Each source fails on its own: a list that fails to download, changes shape or shrinks by more than 20% keeps yesterday's copy and opens an issue, and the publishing job runs none of the project's code and commits only allowlisted JSON.
• Receipts: every citation links to the specific OFAC or UK list entry, lobbying or FARA filing, or EU legal act rather than a home page; uptime is monitored on a public status page.

Built in one day with a team of four at the VAST Data Builders Challenge: Real-Time Video Agents Hack (NYC). Demo video.

• Problem: stores count foot traffic but can't see what the street is wearing.
• What it does: YOLO11 finds and tracks each person in footage indexed in VAST VSS, a Gemma 4 vision model labels what they wear and carry, and the app replays the cameras with labels on the boxes, searches labels ("backpack"), and rolls them up into a dashboard and merchandising suggestions.
• My part: the system architecture, the frontend, and CI/CD: GitHub Actions build checks on PRs, auto-deploy of the app to auraafit.tech, and uptime monitoring.
• Receipts: every search match links to its clip and timestamp in VAST, and every labelling call is traced with the crop, prompt and answer.
• Privacy by design: a guard filter keeps clothing and carried items only; age, gender, race and faces are never inferred, and nothing is tracked across cameras.

Built in one day with a team of three at Trace the Unseen: Climate Intelligence Build Day (Microsoft Garage, NYC), sanctions & evasion track.

• Problem: after Russia's full invasion of Ukraine, Western chips kept reaching Russia through new countries and short-lived companies, and governments listed those companies 15 to 20 months after they first appeared. Name-matching lists arrive too late.
• What it does: tracks what stays the same for years (the product, the buyer and the route) using shipment, ownership and trade-link data from Sayari and Tradeverifyd over MCP, cross-checked against UN Comtrade, official US, UK and EU sanctions lists, and web sources found with Tavily.
• My part: the idea, and the knowledge graph (Python + force-graph) linking 1,552 sanctioned ships to 1,513 US lobbying reports: 3,205 nodes and 3,754 links.
• Receipts: every raw API answer is saved with its call time, so each number on screen traces to a record.
• Scope rule: names only officially listed entities and describes conduct; it never calls anything illegal.

Started as a one-day team build at the Money Talks AI x Finance Hackathon (NYC), Regodit Trust & Risk track, then rebuilt solo into a live app.

• Problem: security questionnaire answers are scattered across policies, audits, pentests and access records, and those sources sometimes contradict each other. Each questionnaire costs a security lead one to three days.
• Models judge, code decides: an LLM reads each retrieved passage's stance on the question; deterministic code assigns the label, re-checks every cited quote against its source and flags dated contradictions.
• Console: column mapper for the buyer's spreadsheet, an evidence drawer with the quote highlighted in its document, a short interview for what the documents don't cover, xlsx export, and a NIST CSF 2.0 gap check.
• How it's checked: CI-gated evals on a dev pack and on a second company written in parallel and scored only after the engine was frozen (reported, not tuned), plus Langfuse tracing.
• Try it: "Try with a sample company" on the live site is instant and needs no signup or key.

• Rules decide, AI explains: deterministic checks over public CMS data (duplicates, NCCI unbundling, MUE unit limits, invalid codes, prices far above Medicare rates) find the errors; the AI only explains them, and every number in an explanation is checked against the evidence.
• PDF bills: a vision model reads the line items with a confidence score per field, and anything hard to read goes to a line review screen before the audit runs.
• Human in the loop: findings are accepted or rejected by a person, and dispute letters are only exported after approval.
• Built to demo safely: each visitor gets a private synthetic workspace, with AI spend budgets, an audit log of every action, and CI that runs the evals and Playwright end-to-end tests.

• What it does: a risk terminal that labels the current regime and shows asset risk side by side for presentations and review.
• Offline first: demo mode needs no API keys, so anyone can open it.
• Ready for live data: hooks for future risk feeds, while the demo stays offline.