Remediation engineering when the fix requires code.
When a verified fix in an application, API or backend needs production code, I can write it. We agree the change before I start, and I hand it over with tests and documentation.
- Best fit
- A defined change
- A security-sensitive component or a structural fix.
- Scope
- Agreed upfront
- Boundaries and acceptance criteria set before work starts.
- Delivery
- Production-ready
- Code with tests, plus the documentation agreed in scope.
When it fits
Fixes that have to be written as code.
Some findings can only be closed by redesigning an authorisation flow or rebuilding a security-sensitive component.
I take on that work when the change can be scoped clearly and handed back to your team. I start from how the system is deployed and who will maintain it, and aim for the smallest change that removes the weakness.
Process and timing
The change is agreed before any code is written.
The result is accepted against a test agreed at the start.
- Agree the change
We name the component to change, who will own it and the test that proves the work is done.
- Design the fix
I map where untrusted input enters the component and how it fails, then pick the smallest change that removes the weakness.
- Build and test
I write the change with automated tests, including one that replays the attack from the original finding.
- Hand it over
I document how to deploy it and why it was built that way, so your team can maintain it.
Frequently asked questions
Questions about remediation work.
What kinds of project fit this service?
A specific component or a security-sensitive change, usually one that came out of a pentest or a code review. General product development and team augmentation are outside this service.
Can you work with an existing codebase and team?
Yes, that is the usual case. I can deliver the change on my own or work alongside your engineers, and before starting we agree access, code review and handover.
What do we receive?
Whatever we agree during scoping. Usually that is working code with automated tests, plus deployment configuration, technical documentation, a record of the security decisions taken and a handover session.
How is AI used during development?
I may use AI tools to compare implementation options or to speed up routine work. Your code and data are never sent to an external AI service without your written approval. I review and test every change myself, and I never take AI output as proof that code is correct or secure.
Other services
Where these changes usually come from.
Web, API & mobile penetration testing
A test of your web app, API or mobile app, the cloud it runs on and any device that connects to it.
Finding validation
Findings from scanners, AI tools or earlier assessments, checked one by one in your code. You learn which are real and how to fix them.
Product security support
Short reviews between pentests: a sensitive change before release, or a fix that needs retesting.
Most changes start from a finding report.
Send it with the current stack and the target date.
Prefer to write directly? [email protected]