Security & Access Management
Deciding who can reach what
Accounts, passwords and permissions arranged so people hold exactly the access their job needs, and leavers lose it that day.
Photo: WFranz / Pixabay 
Photo: gcleaves / Pixabay
Selected work demonstrating this service.
-
Built organization context switching for users
Designed an organization context‑switching system with client localStorage and server‑side cookie mirroring, letting users act as managed organizations while enforcing least‑privilege authorization.
-
Built email with failover and delivery logging
Built email as a platform capability — three providers with failover, delivery webhooks, send and delivery logging, templating and campaigns — behind a startup check that will not boot without one.
-
Hardened the application with nonce‑based CSP
Hardened the application with nonce‑based CSP, HSTS, SameSite cookies, least‑privilege database roles and server‑side entitlement re‑checks.
-
Built Stripe and in‑app purchase entitlements
Built the payments and entitlements layer — Stripe alongside Apple and Google in‑app purchase — gating the directory, search and export through an 11‑table access model checked on the server.
-
Built fail‑closed rate limiting and anti‑abuse
Built fail‑closed abuse controls — 22 Redis‑backed rate limiters, Cloudflare Turnstile, request idempotency and an origin lock — so the platform sheds bots and floods instead of trusting its callers.
-
Built company ownership claims and adjudication
Built company ownership claims end to end — a user claims a company, an administrator adjudicates, and an approval rewrites the authorization graph that decides who is allowed to edit what.
-
Reached the unused half of the core
Reached the half of the messaging core the application had never used — backup transfer, disappearing messages, message editing and resending, verified invitations, proxies and encryption policy — driving every test against the real library with no mocks.
-
Published a readable Tor onion mirror
Published the site as a Tor onion mirror on a readable address beginning engineer, with the key generated off the host so it never reached this repository or a laptop, and left it the one front door of four that is never counted.
If this is the work you need done, the next step is a conversation.
Tell us the problem and we will tell you honestly whether we are the right people.
