The work
The report on it, in full
Every finding written the way yours would be, nothing blurred out, including the parts the read could not reach.
About
A practice, not a personality.
One engineer, one product, one price. Apps built with Lovable, Bolt, Cursor and Replit go through a method I wrote and publish, and I sign what comes out of it.
Thirteen years building and operating web products — the operating part being where you learn which mistakes actually cost money.
There is no name and no photo on this site. For professional reasons I am keeping the practice unattributed for now, and that is the whole of it.
If that is a problem before you hand someone your repository, ask me for a call. I will take you through what I have built and operated, and you can judge the person as well as the standard.
Buying the audit still needs no call. This one is for you, not for me.
Check my work
Open these before you decide.
No login, no email, nothing to buy. Judge these, and the standard behind them.
The standard
What I check, published
The seven domains, the five flaws named, the point where the scope stops, and the commitments your code is handled under.
How I hold myself
Fixed scope. Nothing hidden.
Read-only access, used for the audit and nothing else.
I hand you findings; the launch call stays with you.
Fixed price, fixed scope, no upsell mid-audit.
What I could not see is named in every report.
Code and credentials deleted after delivery; NDA on request.
When your app needs more than the audit, I say so before you pay.
The full version, including the seven domains and where the scope stops, is on the standard.
Contact
Questions before you start?
Write to me about your app, the audit, or anything this site leaves unclear — including that call, if you would rather see who you are dealing with first. Short is fine.