Security Audit
OWASP review, auth + RLS audit, dependency CVEs, and a light pentest.
A scoped audit + report against the real stuff that bites web apps: OWASP Top 10 in code, auth / RBAC / Supabase RLS in practice, secrets leakage, dependency CVEs across transitive deps, and a targeted manual pentest for the high-value flows. You get a prioritised remediation plan; the fix work is a separate engagement.
What you get
4 pillarsOWASP + auth review
Code review against the OWASP Top 10. Authentication flow audit, RBAC / RLS validation, session handling.
Secrets + dependency scan
Repo and commit-history scan for leaked secrets, env var hygiene, rotation plan. npm audit / Snyk / OSV across transitive deps with a prioritised patch list.
Database / RLS review
Supabase RLS policy review, privilege audit, query-injection checks. Where the app actually leaks data — usually the database.
Light pentest
Targeted manual pentest on the high-value flows — auth bypass, IDOR, SSRF basics. Findings written up with severity and a fix path.
Tools we reach for
Not exhaustiveMore in Web App Development
Core overview →E-commerce
Headless commerce, multi-brand, custom configurators.
Custom Web Applications
SaaS dashboards, portals, kiosks — multi-tenant and role-aware.
Static + Basic Sites
Marketing, landing, brochure, MDX — fast, accessible, SEO-clean.
API Design + Backend Architecture
REST, GraphQL, tRPC — versioned, observable, integration-ready.
Database Architecture
Postgres-first. Migrations, RLS, pgvector, multi-tenant isolation.
Performance + Platform Engineering
Core Web Vitals, edge rendering, caching, observability.
WordPress & WooCommerce
WP sites, WooCommerce stores, custom themes, plugins, headless.
UI / UX Design
Research, wireframes, design systems, and motion polish.
QA + Testing
End-to-end, integration, visual regression, and performance gates.
Frequently asked
4 questionsWhat does a security audit cover?
OWASP Top 10 review (injection, broken auth, XSS, CSRF, SSRF, IDOR), dependency vulnerability scan (Snyk, OSV), secret leakage check, auth and session config review, CSP headers, rate limiting, and infrastructure hardening. Output is a prioritized remediation report.
Do you audit Supabase RLS policies?
Yes — RLS is where most multi-tenant leaks hide. Every policy reviewed for correctness, default-deny verified, edge cases tested (anon, service role, cross-tenant queries). Audit produces test cases that prove tenancy holds.
Pentest scope and methodology?
Black-box, gray-box, or white-box depending on engagement. Manual testing with Burp Suite for application-layer vulnerabilities. Authenticated and unauthenticated scenarios. Findings ranked by CVSS and chained-impact, not just raw count.
SOC 2, HIPAA, or GDPR readiness?
Pre-audit gap analysis for SOC 2 Type II or HIPAA. PHI handling review for healthcare apps. GDPR data-mapping, lawful-basis review, and DPA template guidance. Not the same as a certified audit — get you ready for one.
Sounds like the bucket you’re in?
Tell me what you’re trying to build. I’ll send a written proposal within 48 hours of our discovery call.