Work samples
The documents, not the description
Four deliverables, each one complete enough to judge. Real client documents stay private, so the subjects here are fictional and the findings invented — the format, the evidence standard and the reasoning are the parts that carry over. Every external claim in them is cited and checked.
-
Production diagnostic
A clean deploy that could not serve.
The memo a production diagnostic hands back. Three ranked causes for a system that is stable at low load and degrades under sustained traffic: an N+1 query on the largest accounts, a burstable RDS instance out of headroom, and a deploy pipeline whose health check proves a task is running but not that it can serve. Written from an intake packet, with no shell or production access assumed. The company is fictional and every finding invented.
Node.js · AWS ECS · Deploy pipeline 4 pages
Read it -
Pre-launch security review
A where clause is not a boundary.
The findings section of a pre-launch security review, answering the question the client actually asked: is this safe to put a competitor's data into? Three findings from a multi-tenant SaaS on Node.js, PostgreSQL and AWS. The P0 is a composite chain rather than a list of separate weaknesses — a token claim never re-checked against current membership, row-level security enabled on 3 of 19 tenant-scoped tables, and an application role that owns those tables and is therefore exempt from the policies on them. The subject is fictional and every finding invented; external claims are cited to PostgreSQL, OWASP and AWS documentation.
PostgreSQL · Row-level security · Multi-tenant SaaS 3 pages
Read it -
Technical accuracy review
Correct is not the same as complete.
One section of a technical accuracy review, checking a hardening guide's Content Security Policy advice for a self-hosted Node.js deployment. The verdict is "accurate but incomplete": the advice is sound in principle, and the project's own upstream history shows a fixed policy being shipped, breaking deployments, and being reverted. The excerpt under review is illustrative, but every claim about the project is checked against public upstream sources and cited.
Node.js · CSP · Security documentation 1 page
Read it -
Technical due diligence
See what the buyer could see.
The report a buyer's technical reviewer hands to the deal team. Thirteen findings on a fictional multi-tenant SaaS, tiered by treatment: four that warrant attention before close, five that are warranty, escrow or disclosure candidates, three for the post-close backlog, and one IP question escalated to counsel. The tenant boundary was tested by recording one tenant's traffic and replaying it as another, which gives a pass or fail per route. The target is fictional and every finding invented.
Buy-side · Multi-tenant B2B SaaS · NestJS / Next.js / PostgreSQL / AWS 9 pages
Read it
An audit provides findings and priorities. Implementation and verification can be scoped separately.