Technical overview
How I harden web applications
Application security is layered work: input validation, output encoding, CSRF tokens, CSP headers, secure cookies and HTTPS with HSTS. I review against common OWASP risks and fix SQL injection, XSS and weak auth in existing PHP or Node codebases.
Password hashing uses bcrypt or Argon2; admin panels get 2FA or IP allowlists when exposure is high. Rate limiting and brute-force protection sit on login and token endpoints. Dependency audits on Composer and npm catch known CVEs before they become incidents.
I treat every input as untrusted. Session fixation, open redirects on payment return URLs and over-permissive CORS are common launch blockers. When a formal pentest is required, I remediate findings in the stack and verify the fixes.
Common security tasks I help with
- How to fix SQL injection in a legacy PHP query
- How to stop XSS in user-generated content
- How to add CSRF protection to form-heavy admin tools
- How to set CSP headers without breaking trusted scripts
- How to enable 2FA on an admin login
- How to rate-limit login and token endpoints
- How to audit npm and Composer dependencies for CVEs
- How to configure secure cookies and HSTS correctly
- How to close open redirects on payment return URLs
- How to remediate findings from an application security review