Skip to main content
Code Hippies

Security & compliance consulting

OWASP-grade hardening, dependency hygiene and honest compliance advice

Application security review against the OWASP Top 10, security headers, dependency scanning in CI, and straight guidance on what compliance work you can automate and what genuinely requires auditors and money.

Discuss this project One-week review and hardening pass; ongoing coverage under a retainer.

What you get

  • Review against the OWASP Top 10 with reproducible findings
  • Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
  • Server-side input validation and output encoding on every mutating route
  • CSRF protection and rate limiting on public endpoints
  • Dependency scanning wired into CI, failing the build on high and critical findings
  • Secrets audit — nothing sensitive reaching the client bundle

Stack options

Chosen per project against your constraints. No single engagement uses all of these.

Application
Input validation (zod)Output encodingCSRF tokensRate limitingSession hardening
Transport
Strict-Transport-SecurityContent-Security-PolicyReferrer-PolicyPermissions-Policy
Supply chain
npm audit in CILockfile disciplineRuntime version currency

Most breaches are boring, and so is preventing them

Unvalidated input, a mutating endpoint with no CSRF token, an unauthenticated form with no rate limit, a secret that ended up in the client bundle, a runtime three major versions past end of life. The work is checking each of these deliberately rather than assuming the framework did it. One portfolio project runs PHP 8.2.30 specifically because a supported runtime that still receives patches is a security control, not a preference.

Validate on the server, always

Client-side validation is a user-experience feature. Every schema on this site is defined once with zod and enforced again inside the route handler, because the client is not a trust boundary. That is also why every mutating route here is CSRF-protected and rate-limited by IP.

What I will not pretend to automate

Domain registration, ICANN registrant verification, EV certificate issuance, SOC 2 and ISO 27001 audits, penetration test attestation letters — these require legal identity, payment and independent third parties. I will scope them, prepare the evidence, implement the technical controls an auditor will ask for, and tell you plainly what it costs and how long it takes. What I will not do is imply that a script can produce a compliance certificate.

Proof

Security & compliance consulting in production

Live builds where this work was actually done, with the technical signals verified on each site.

  • News & Publishing2026

    CarbonMedia

    EngineeringRuns on PHP 8.2.30 (declared in x-powered-by) — a maintained, current runtime rather than a legacy 7.x install — serving a custom news application with three reader-facing forms, GA4 property G-BVNH0Z14GM and AdSense inventory, with WebSite + SearchAction JSON-LD.

    In plain termsCovers news, business, tech, sport and politics under one brand, and lets readers search and subscribe without leaving the page.

    • PHP 8.2
    • Custom CMS
    • GA4
    • Google AdSense
    Read the case studycarbonmedia.in(opens the live site in a new tab)
  • News & Publishing2026

    ReadyNews

    EngineeringA purpose-built PHP news portal (single /assets/js/app.js bundle with a cache-busting version query, no CMS footprint in the markup) behind Cloudflare, carrying a complete news structured-data graph — NewsMediaOrganization, CollectionPage, ItemList, BreadcrumbList, ImageObject, SearchAction — with GA4 and AdSense wired in.

    In plain termsA news site that loads fast on a cheap phone because there is no plugin stack sitting between the reader and the story.

    • PHP
    • Custom CMS
    • Cloudflare
    • GA4
    Read the case studyreadynews.in(opens the live site in a new tab)
  • News & Publishing2025

    NewsLive24

    EngineeringWordPress origin behind nginx, instrumented with GA4 via Google Tag Manager and monetised with Google AdSense; the document carries the richest structured-data graph of the portfolio — NewsArticle, NewsMediaOrganization, CollectionPage, ItemList, ContactPoint and SearchAction — plus hreflang alternates.

    In plain termsRuns a full English news desk on a CMS the editors already know, while the technical SEO and ad plumbing is handled underneath them.

    • WordPress
    • nginx
    • GA4 / Tag Manager
    • Google AdSense
    Read the case studynewslive24.in(opens the live site in a new tab)

FAQ

Questions about security & compliance consulting

  • Is this a penetration test?

    No. This is an engineering review: reading the code and configuration, checking controls against the OWASP Top 10, and fixing what is found. A formal penetration test with an attestation letter comes from an independent testing firm, and I will help you scope and prepare for one.

  • Can you get us SOC 2 compliant?

    I can implement and document the technical controls an auditor will look for, and prepare the evidence. The audit itself must be performed by an accredited third-party firm — that is what makes the certificate mean anything. Anyone claiming to automate the audit is describing the preparation, not the audit.

  • How often should dependencies be scanned?

    On every push, as a build step that fails on high and critical findings. A monthly manual check means you are, on average, two weeks behind a published exploit.

Start a security & compliance consulting engagement

Send the brief with your project type, budget band and timeline. You'll get a scoped recommendation and a fixed price against a written scope.

Start a project Message on Email