# Security > Selected Engineer ApS work demonstrating Security — the achievements that prove it. - [Improved geographical map application performance by 10x through strategic database transition from MSSQL to PostgreSQL, optimizing processing and data security.](https://software.engineer.company/portfolio/improved-geographical-map-application-performance-by-10x-through-6/) - [Designed an organization context‑switching system with client localStorage and server‑side cookie mirroring, letting users act as managed organizations while enforcing least‑privilege authorization.](https://software.engineer.company/portfolio/designed-an-organization-context-switching-system-with-client-59/) - [Built email as a platform capability — three providers with failover, delivery webhooks, send and delivery logging, templating and campaigns — behind a startup check that will not boot without one.](https://software.engineer.company/portfolio/built-email-as-a-platform-capability-with-failover-62/) - [Designed a PostgreSQL function‑first data layer — 1,275 stored functions across 34 schemas — so every read and write goes through a function the database can grant, rather than through a table.](https://software.engineer.company/portfolio/designed-a-postgresql-function-first-data-layer-across-63/) - [Hardened the application with nonce‑based CSP, HSTS, SameSite cookies, least‑privilege database roles and server‑side entitlement re‑checks.](https://software.engineer.company/portfolio/hardened-the-application-with-nonce-based-csp-hsts-77/) - [Set the platform's founding decisions in the weeks after the repository opened in November 2025 — the layering, database‑first data access and the zero‑warnings bar — and they still hold nine months on.](https://software.engineer.company/portfolio/set-the-platform-s-founding-decisions-in-november-2025-80/) - [As one of the first hires, designed and built the entire core infrastructure and supporting processes from scratch for a green‑energy SaaS startup, laying the foundation for rapid growth.](https://software.engineer.company/portfolio/as-one-of-the-first-hires-designed-and-86/) - [Built the payments and entitlements layer — Stripe alongside Apple and Google in‑app purchase — gating the directory, search and export through an 11‑table access model checked on the server.](https://software.engineer.company/portfolio/built-the-payments-and-entitlements-layer-96/) - [Built first‑party error monitoring and OpenTelemetry tracing rather than buying them — payload sanitising, spike and regression detection, symbolication and a synthetic heartbeat — behind 11 operator views.](https://software.engineer.company/portfolio/built-first-party-error-monitoring-and-tracing-98/) - [Built fail‑closed abuse controls — 22 Redis‑backed rate limiters, Cloudflare Turnstile, request idempotency and an origin lock — so the platform sheds bots and floods instead of trusting its callers.](https://software.engineer.company/portfolio/built-fail-closed-abuse-controls-and-rate-limiting-100/) - [Built company ownership claims end to end — a user claims a company, an administrator adjudicates, and an approval rewrites the authorization graph that decides who is allowed to edit what.](https://software.engineer.company/portfolio/built-company-ownership-claims-end-to-end-103/) - [Wrote a parser that reads the real 7,308‑line C header and verifies every call site, every enum constant and that every pointer‑owning class is final, after a hand‑written placeholder header let calls to three removed functions compile, link and crash.](https://software.engineer.company/portfolio/wrote-a-parser-that-verifies-every-ffi-call-site-157/) - [Reached the half of the messaging core the application had never used — backup transfer, disappearing messages, message editing and resending, verified invitations, proxies and encryption policy — driving every test against the real library with no mocks.](https://software.engineer.company/portfolio/reached-the-unused-half-of-the-messaging-core-161/) - [Rewrote the application's error messages against a written tone standard after a refused sign‑in blamed the user for mistyping when the provider actually required an app‑specific password, and covered it with a test that names the provider.](https://software.engineer.company/portfolio/rewrote-the-error-messages-against-a-tone-standard-162/)