Security

• Improved team communication and collaboration

  Improved team communication and collaboration by implementing Slack, Mattermost, 1Password, and Jira, saving 8,000 hours of labor.

• Set the platform's founding technical decisions

  Set the platform's founding decisions in the weeks after the repository opened in November 2025 — the layering, database‑first data access and the zero‑warnings bar — and they still hold nine months on.

• Automated team collaboration

  Automated team collaboration, password management, task and time management, and built a semi‑automatic project‑showcase system, raising team productivity.

• Built Stripe and in‑app purchase entitlements

  Built the payments and entitlements layer — Stripe alongside Apple and Google in‑app purchase — gating the directory, search and export through an 11‑table access model checked on the server.

• Built company ownership claims and adjudication

  Built company ownership claims end to end — a user claims a company, an administrator adjudicates, and an approval rewrites the authorization graph that decides who is allowed to edit what.

• Ran a continuous security scanning programme

  Established a continuous security programme — code scanning, DAST, dependency and vulnerability checks, SBOM generation, secret scanning and SHA‑pinned actions — alongside 21 written security audits.

• Wrote a scope rule after a credential leak

  Wrote a scope rule into the repository after a restructure carried another company's inventory, firewall allowances and prose into it — and kept the quarantined residue under the secret scanner rather than excluding it.

• Wrote a parser verifying every FFI call

  Wrote a parser that reads the real 7,308‑line C header and verifies every call site, every enum constant and that every pointer‑owning class is final, after a hand‑written placeholder header let calls to three removed functions compile, link and crash.

• Rewrote error messages to stop blaming users

  Rewrote the application's error messages against a written tone standard after a refused sign‑in blamed the user for mistyping when the provider actually required an app‑specific password, and covered it with a test that names the provider.

This work is part of what we offer as Security & Access Management, Technical Documentation, Backend & API Development, DevOps & CI/CD Automation, Product Strategy & Requirements, AI Agent Security, Full‑Stack Product Development and Project Management (Agile).

Building something that needs this? Get in touch.