A black-box test finds what an outsider can reach in a week. Reading the code finds the hardcoded credential, the query built by concatenation, and the endpoint that forgot its authorisation check. If you inherited this codebase, the second list is the one that should keep you up.
An enterprise prospect sent a security questionnaire or a vendor review, and nobody on your team can answer it honestly. The deal sits still while you work out what to say.
Someone else wrote it and left. You have no idea what it logs, what it stores, what it exposes, or which dependency has not been touched in three years.
You need it for the next tier of customer, and you would rather find the gaps now than pay an auditor three times as much to find them for you.
Four things, and they can be bought separately or together.
Readiness work, not the audit. The audit itself has to come from a licensed CPA firm.
Every entry carries a severity, the file it lives in, why it matters in your context, and a fix you can apply.
| Ref | Finding | Severity | Fix |
|---|---|---|---|
| S-01 | Password reset tokens generated with Math.random(), predictable across sessions | critical | 2 hours |
| S-02 | Tenant identifier taken from the request body, not the session — cross-tenant read possible | critical | 1 day |
| S-03 | Stripe secret key present in git history from an early commit, never rotated | critical | 1 hour, plus rotation |
| S-04 | Report export builds SQL by string concatenation on a user-supplied sort field | critical | 3 hours |
| S-05 | JWTs signed but never checked for expiry on the websocket path | high | 3 hours |
| S-06 | Full request bodies written to logs, including card metadata and addresses | high | 4 hours |
| S-07 | File upload trusts the client-supplied content type, no extension allowlist | high | 5 hours |
| S-08 | Nine transitive dependencies with published CVEs; two reachable from request handlers | high | 1 day |
An anonymised composite of the kind of finding this work surfaces. Yours arrives in the same shape, with file and line for every entry, plus an executive summary short enough that your buyer's security team will read it.
For comparison: a scoped application penetration test runs $4,000 to $8,000 at seed stage and $8,000 to $15,000 at Series A. A consultant-led SOC 2 readiness assessment runs $5,000 to $15,000.
If you inherited the codebase, the security review and the 21-day backend rescue cover the same repository from two directions — one makes it defensible, the other makes it maintainable. Taken together, the $1,800 diagnostic comes at no extra cost.
Two of these are live products you can open right now. The third is the platform I architect in my day job.
Senior Node developer, 2023 to present
Architected a platform consolidating CRM, records, scheduling and multi-branch operations for a clinical group.
Sole architect and developer — tujade.com
A multi-tenant ERP for small and mid-size businesses, with double-entry accounting as the system of record.
Sole architect and developer — micanchaya.com
Tournament management and ticketing, with a paying client running live competitions on it.
A master's in digital forensics and cybersecurity from CUNY John Jay in New York, on top of a bachelor's in computer science and twelve years of building software. I have also held the job directly: an IT security specialist role for a UK company, automating workstation and server security monitoring in Python, Bash and PowerShell, and triaging incidents across global teams.
The part that matters more for a code review is that I am a working backend engineer, not a security generalist meeting your stack for the first time. I architected a platform serving 600 internal users and a thousand daily prospects, built the Kafka pipelines behind it, and run two multi-tenant products of my own — one with schema-per-tenant isolation, rotating refresh tokens hashed with Argon2id, TOTP two-factor and CSRF protection, because I had to make those decisions myself and live with them.
That combination is the whole offer. I can tell you whether a finding is genuinely exploitable in your architecture rather than theoretically exploitable in general, and then hand you the patch — because I write this code every working day.
Ambato, Ecuador. UTC−5, which is New York's working day. English C1, Spanish native.
No, and the distinction matters enough to lead with it. A penetration test attacks your running application from the outside. This is a review of the source code, which finds a different and usually larger set of problems — the ones an attacker would need luck or a lot of time to stumble into. If a customer contract specifically requires a third-party penetration test, say so on the call and I will point you to someone who does that properly.
No. A SOC 2 report can only be issued by a licensed CPA firm, and anyone telling you otherwise is selling something that will not survive contact with your customer's procurement team. What I do is the readiness work that comes before: find the gaps, build the evidence plan, fix the technical controls, so that the audit is not the first time you discover what is missing.
A written report with every finding rated by severity and exploitability, the specific file and line, why it matters in your context, and how to fix it with working code. Plus an executive summary short enough that your buyer's security team will actually read it, and a call to walk through all of it.
Read access to the repository, and a conversation about your architecture. Nothing in production. I will sign your NDA before anything is shared, or use mine if you prefer.
You hear about it the day I find it, not in the report three weeks later. Anything actively exploitable is escalated immediately, with the fix, before the rest of the engagement continues.
Tell me what triggered this — a questionnaire, an inherited codebase, or an audit on the horizon. You will leave knowing what needs doing and what it costs, whether or not you hire me.