Four ways to work with us.
Getting a prototype to work is cheap. Knowing which twenty things not to trust takes judgment. We harden what works, set up the rails, and train your team to build safely without us.
Harness Kit
Our editor rules, RLS test templates, CI checks, staging template, and production checklist. Open source and ungated. Use it with or without us.
- Hardened
.cursorrules& Claude system prompt - Row-Level Security (RLS) test suite template
- GitHub Actions CI workflow for Next.js & Supabase
- Pre-launch 10-point security checklist
Harness Check
A candid 30-minute diagnostic call. Beforehand, John looks at your live app from the outside (zero repo access needed). You get an honest written summary afterward.
- Zero repo or private credential access required
- External security surface and header evaluation
- Written 3-point remediation summary in plain English
- Honest feedback on whether you actually need a sprint
Harness Sprint (2 Weeks)
One production app, hardened in a fixed 2-week sprint. Auth, RLS tests, secrets, webhooks, staging, monitoring, and a runbook. Every change arrives as a reviewed PR with a plain-English note.
- Auth & Permissions: Role hierarchies & database RLS with automated tests
- Secrets Hygiene: Server-only credentials, zero browser leaks
- Webhook Hardening: Signature validation & idempotency (Stripe, Resend)
- Staging Pipeline: Safe test environment so nothing breaks production
- Observability: Error tracking, alert routing, and cost spike limits
- 14-Day Slack Lifeline: Post-sprint human follow-up included
Harness Sprint (4 Weeks)
For multi-service architectures, complex data pipelines, high-concurrency tooling, or applications requiring deep database refactoring and compliance readiness.
- Everything included in the 2-week Harness Sprint
- Multi-tenant schema restructuring & zero-downtime migrations
- Database restore drills & automated backup verification
- Query optimization & connection pooling setup (Supabase PgBouncer)
- 30-Day Slack Lifeline: Extended post-sprint architecture reviews
Team Enablement
Two live working sessions with the people who keep prompting the app, plus a custom PR review rubric and two follow-up reviews of their own PRs. So the next hundred prompts don't undo the sprint.
Harness Retainer
After a sprint: a direct Slack lifeline to John, proactive reviews of risky PRs (auth, schema, payments), and regular harness updates. For teams without a full-time senior engineer in-house.
Zero production credentials by default.
We treat your intellectual property with uncompromising security hygiene.
We only request access to the specific repository being hardened, nothing else.
We build and test against sanitized staging databases, never live customer data.
Credentials shared strictly via 1Password or Bitwarden. Never plain text in chat.
All GitHub and staging permissions are formally revoked in writing on the final day.
Bring the app. We'll bring the checklist.
30 minutes, no sales decks. You'll leave with the first three things we'd fix, whether or not you hire us.