Security consulting
Security-focused code and architecture reviews, and hardening for web applications.
Scope
A narrow, focused offer
Security isn't a feature you bolt on at the end. This is for teams who want a second pair of eyes on how their web app is built and configured.
In scope
- Code review of a web application, with a security focus
- Architecture review: how auth, data and secrets flow through the system
- Hardening of configuration and HTTP security headers
- Web apps in general, with particular depth in Next.js / React and Node.js
Not in scope
- Certified penetration tests or compliance audits
- 24/7 monitoring or incident response retainers
What a review covers
Layered defence, checked layer by layer
The checklist comes from my write-up on securing Next.js applications.
Authentication & sessions
How tokens are issued, stored and revoked: JWT versus server sessions, short-lived tokens, and httpOnly, secure, sameSite cookies instead of localStorage.
Content Security Policy
Whether a strict CSP is in place, nonce-based script policies, and the other headers that limit what a page can load or be framed by.
Rate limiting
Throttling on API routes, especially login and other authentication endpoints, and whether the store works across serverless instances.
Secrets & environment variables
What ends up in the client bundle (NEXT_PUBLIC_), where secrets live, validation of env vars at build time, and rotation.
Input validation & defence in depth
Validation at every boundary, misconfigured API routes, and dependencies, checked against the OWASP Top 10.
Process
How a review runs
- 01
Discover
We agree on what is being reviewed, how I get access, and what matters most to you.
- 02
Threat-model
I map the assets, entry points and likely attacks, so the review targets real risks.
- 03
Review
Code, configuration and architecture are checked against the areas above.
- 04
Report & hand over
Findings are walked through with your team, with fixes prioritised by risk.
Deliverables
What you get
- A written report of findings, each with its risk and a recommended fix
- A prioritised remediation list, ordered by impact
- Concrete configuration or code suggestions where they help
- A walkthrough call to answer your team's questions
Pricing on request.
Want a security review?
Tell me about the application and what you'd like reviewed.