Security audits and incident response.

XPEERX: a multi-chain custodial crypto platform, built for mainnet

Designed and hardened a custodial crypto deposit, custody and trading platform across six chains — deposit watchers, RPC failover, sweep automation and a security-audited admin/merchant surface — from testnet through to a live mainnet launch.

Six chains, one watcher that never silently falls behind.

Client

Self-funded fintech product (XPEERX)

Year

2026

• NestJS
• Next.js
• PostgreSQL
• BullMQ

A Safe Browsing blocklisting that file cleanup could never have fixed

A client site was blocked by Google Safe Browsing. The phishing content was real, but it was never served from their server — a malicious wildcard DNS record pointed their subdomains at attacker infrastructure.

Client

Industrial supplier, South Asia

Year

2026

• cPanel
• DNS
• WordPress
• Google Search Console

Security audit of an AI-generated Supabase backend

Audited a largely AI-generated Supabase backend before production launch and found four critical issues, including a cross-tenant write path, delivered as a findings report followed by remediation.

AI wrote your backend. Who checked the RLS policies?

Client

US PropTech startup

Year

2025

• Supabase
• PostgreSQL RLS
• Next.js

The redirect was not on the server — proving it at the CDN

Two previous cleanups had found nothing because the redirect was generated by the CDN, not the website. Differential testing proved it in twelve seconds, and the audit uncovered a second, undocumented compromise.

Client

Creative agency, United Kingdom

Year

2026

• Cloudflare
• cURL
• WordPress
• cPanel