How we work
From first email to handover
What happens at each step of working with us, and the rules the work follows at every one of them.
The steps
What happens, in order.
You write to us
Describe the system, the constraint you are up against, and roughly when you need it. We reply, usually within two business days, and say plainly whether we are the right people. If we are not, we will usually know who is.
A scoping call
We tell you what we would actually look at. It is no charge, and no obligation, and nothing is quoted before it.
A written proposal
Fixed scope, fixed fee, and what you get at the end of it. Ongoing build work is monthly. Once signed, that agreement governs the work, not anything on this website.
The work
Most reviews are fixed scope and run one to three weeks. Builds are ongoing, with the authorization model, validation, rate limits and tests going in alongside each feature. Training runs in cohorts of up to twelve: about a third instruction, two thirds supervised work on your own systems.
Handover
Every engagement ends in something you can act on without us: ranked findings with a suggested fix and a regression test for each, a decision document, working software with its test suite and documentation, or training materials your team keeps and re-runs.
The rules
What holds at every step.
Security is part of "done."
Input validation at the trust boundary, parameterized queries, authorization scoped to the authenticated user, fail-closed defaults and rate limits go in with the feature, not in a later pass.
Every change ships with tests.
Including the paths where it should refuse. Every bug fix gets a regression test that failed before the fix, and if the suite is red, we say so.
Every finding comes with its failure scenario.
Concrete inputs and a concrete consequence, because a finding you cannot picture is a finding nobody fixes.
We would rather say no.
To a project where we are not the right people, and to features that break platform terms or lend themselves to disinformation.
We claim only what you can check.
No certification we do not hold, and no number on a product page that cannot be traced to a command we record and will run for you.
The work is designed to end.
A bridge you still need us to stand under is not finished.
What helps us start
The more of this you can tell us, the more useful our first reply is:
- What the system does, and who uses it
- The stack, roughly: languages, cloud, database
- What is actually going wrong, or what you want built
- Any compliance regime you are working toward
- Timeline, and whether there is a budget approved yet
Keep credentials, confidential material and anything under an NDA out of a first message. Say you have something sensitive and we will arrange a proper channel first.
The scoping call is the fastest way to find out whether we are useful to you.