Application Security
I look for the flaws, then I fix them in the code.
Security has been part of every application I deliver for 25 years, not a step added at the end. When a client asks me to look closer, I work the way a developer does: take inventory of what runs, sort by severity, then fix it in the code. The scope is deliberately narrow: application security.
What I check
Four areas, to combine or to take one at a time depending on what your application needs.
Front-end and dependency audit
The method proven at Saint-Gobain: inventory every third-party JavaScript library and establish, for each one, its justification, its provenance, its scope in the application and how it is loaded (bundled or external, CDN). Then rationalise: remove, replace or consolidate.
Application flaws
A review of the code and its configuration: injection, authentication and sessions, HTTP headers and Content Security Policy, secrets left in code or configuration, server-side dependencies.
I fix what I find
I am a developer before I am an auditor: fixes are prioritised, then written in the code, instead of ending up as a list of recommendations waiting in a drawer. If your team would rather apply them itself, I hand over an action plan ranked by severity.
AI assistant configurations
The files that drive an assistant like Claude Code can allow code to run without a prompt, start unpinned MCP servers or hold secrets in plain text. deadweight, my open-source tool, finds them and grades them by severity.
How we work together
In the usual frame, time and materials, fixed price or consulting, at the day rate displayed on the site. No price list and no packaged offer: the format is chosen to fit the engagement.
What I do, and who it suits
I work on the security of the application itself: its code, its dependencies, its front-end, its configuration. It suits product teams, small businesses and agencies with a JavaScript application in production, or about to be, who want a senior developer's eye on it.
What I do not do
No penetration testing, no infrastructure or network audit, no certification or compliance work (ISO 27001, SOC 2, PCI). For those, I refer you to a specialist firm.
What I can show
Twenty-five years of development, and security has always been part of the job. Here are four things I can describe or show.
Saint-Gobain Homly-you: a two-week front-end audit
The engagement opened with a two-week security audit of the front-end, delivered to the client. The application leaned heavily on JavaScript and third-party libraries. I inventoried each one and assessed its justification, provenance, scope and how it was loaded, then rationalised and optimised: remove, replace, consolidate. The findings stay confidential.
See the case studiesdeadweight: security checks, in the open
My tool (MIT licence) grades by severity what an AI assistant configuration lets happen: rules that run code without a prompt, unpinned MCP servers, a download piped into a shell, hidden unicode characters, secrets in plain text, MCP over http. Measured on 600 public repositories: 5 blanket allows, 2 literal secrets, 93 broad allows in 42 repositories, 47 unpinned MCP servers in 26 repositories.
See deadweightVitaPulse: a security section in every scan
VitaPulse, my web-performance SaaS, adds a Security section to every scan, in four tabs: ten HTTP security headers graded by severity (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options and seven more), TLS details (protocol, cipher, certificate issuer and validity), the software versions the server exposes, and Lighthouse's security audits. It reads what the server and the page expose, not the code or the dependencies. Twenty-six vulnerabilities are documented publicly, in five languages.
See VitaPulseThis very site
The repository is private, so here is what I can say plainly. One-time security codes sent by email are generated with a cryptographic random generator, stored hashed (SHA-256) and compared in constant time. Passwords are hashed with bcrypt. Sensitive routes are rate limited, with IP and account blocking, and reCAPTCHA is verified on the server. Session cookies are hardened and destroyed when credentials change. A Content Security Policy (Helmet) limits what the browser loads. Every week, a dependency audit fails as soon as a high-severity flaw shows up, with Dependabot alongside.
A three-step method
Inventory
I list what the application is made of: libraries, entry points, authentication, secrets, configuration. You cannot protect what you have not listed.
Analysis by severity
Each item is assessed and ranked by severity, so you know what to deal with this week and what can wait.
Fixes or action plan
Depending on your team, I apply the fixes in the code, or I hand over a prioritised action plan for your team to work through.
An application to put under the microscope?
Describe the application and its stack. I will tell you honestly whether my scope fits, and if not, who to turn to.