Work samples
The documents, not the description
Three deliverables, each one complete enough to judge. Real client documents stay private, so the subjects here are fictional and the findings invented — the format, the evidence standard and the reasoning are the parts that carry over. Every external claim in them is cited and checked.
-
Production diagnostic
A clean deploy that could not serve.
The memo a production diagnostic hands back. Three ranked causes for a system that is stable at low load and degrades under sustained traffic: an N+1 query on the largest accounts, a burstable RDS instance out of headroom, and a deploy pipeline whose health check proves a task is running but not that it can serve. Written from an intake packet, with no shell or production access assumed. The company is fictional and every finding invented.
Node.js · AWS ECS · Deploy pipeline 4 pages
Read it -
Pre-launch security review
A where clause is not a boundary.
The findings section of a pre-launch security review, answering the question the client actually asked: is this safe to put a competitor's data into? Three findings from a multi-tenant SaaS on Node.js, PostgreSQL and AWS. The P0 is a composite chain rather than a list of separate weaknesses — a token claim never re-checked against current membership, row-level security enabled on 3 of 19 tenant-scoped tables, and an application role that owns those tables and is therefore exempt from the policies on them. The subject is fictional and every finding invented; external claims are cited to PostgreSQL, OWASP and AWS documentation.
PostgreSQL · Row-level security · Multi-tenant SaaS 3 pages
Read it -
Technical accuracy review
Correct is not the same as complete.
One section of a technical accuracy review, checking a hardening guide's Content Security Policy advice for a self-hosted Node.js deployment. The verdict is "accurate but incomplete": the advice is sound in principle, and the project's own upstream history shows a fixed policy being shipped, breaking deployments, and being reverted. The excerpt under review is illustrative, but every claim about the project is checked against public upstream sources and cited.
Node.js · CSP · Security documentation 1 page
Read it
The memo is the output. The system staying up is the deliverable.