Services
Six practices, one team. Most engagements begin with an audit and continue into whatever the findings turn out to require.
01 Primary focus
AI assistants ship features fast and problems quietly. We audit prompt-generated codebases and turn them into software your team can maintain.
02
Static and dynamic analysis, dependency and secret scanning, and a manual review of the things scanners reliably miss.
03
Marketing sites, dashboards and full web applications built on boring, well-supported technology that still works in three years.
04
iOS and Android applications taken from idea to an approved store listing — including the review paperwork nobody enjoys.
05
Deployment pipelines and infrastructure that let a small team release on a Friday without ceremony.
06
Ongoing review, dependency hygiene, and an engineer who already knows your codebase when something breaks.
Engagement models
Every engagement is scoped and priced in writing before work starts. No open-ended hourly billing.
A fixed-price read of your codebase and infrastructure. You get a prioritised written report and a remediation estimate. No commitment beyond the audit.
Best when you inherited a codebase, or an investor or customer has started asking questions.
We fix the findings in priority order, in reviewable pull requests, and add the tests and CI gates that stop them coming back.
Best when you already know something is wrong and need it resolved before the next release.
New web or mobile product delivered end to end — design, implementation, release pipeline and store submission.
Best for a new product, a rewrite, or a feature your team does not have the bandwidth for.
A fixed block of engineering time each month for review, patching, incident response and steady improvement.
Best once the codebase is healthy and you want to keep it that way.
Our process
We read the codebase, run the scanners, and talk to whoever has been keeping it alive. You get a written picture of what you actually own.
Findings are ranked by exploitability and business impact rather than by scanner severity. You decide what gets fixed and in what order.
We work in small, reviewable pull requests against your branching strategy, with tests that prove each fix holds.
Every finding is re-tested, your pipeline enforces the new baseline, and your team gets documentation written for humans.
Tell us what you have and what worries you. We reply with scope, timeline and a fixed price — and if we are not the right fit, we will say so.