Tabish B.

Shipped an app with Lovable, Bolt, Cursor, or Claude Code and now it feels fragile? I find what is exposed and slow, fix it, and hand back a hardened app. SECURITY FIXES I HAVE DONE ON LIVE PRODUCTS - CSRF and SSRF vulnerabilities - PII exposure - Unsafe file uploads (moved to presigned storage uploads) - Plaintext credentials - Bot abuse on signup (Cloudflare Turnstile) - OAuth flows that leak scope or mix login with API access REAL INCIDENT EXPERIENCE - Contained an AWS compromise with 1,536 unauthorized EC2 instances running across 6 regions, then recovered the credit PERFORMANCE - Lighthouse 97+ on production apps - Database, caching, CDN, and server tuning PROOF - MyUni.dev: 350+ users, self hosted, security hardened after an outside researcher's report - Agencly: multi tenant SaaS with billing, role based access, and CI/CD, built and run solo - Top Rated on Upwork HOW I WORK - Audit first, with a written list of findings ranked by risk - Then fixes, each with a short explanation - Then a final check before handoff STACK Next.js, React, TypeScript, FastAPI, Node, PostgreSQL, Supabase, AWS (EC2, RDS, S3, IAM), Nginx, Docker, Cloudflare, GitHub Actions Message me with your repo or live URL and I will tell you what I would fix first.