Case Studies
Cases.
What we have built and broken for clients. Sanitized, methodology-focused, no names without clearance.
SSRF chain to full cloud-account access
A misconfigured forwarder component on a subdomain served as entry point for a multi-step SSRF chain. End state: a valid compute token with broad read access to the entire cloud account.
Session-lifecycle audit of a consumer marketplace app
A JWT flow that looked correct was broken in two places: refresh tokens stayed valid after rotation, logout was cosmetic only. The audit exposed a high-severity chain that would have enabled account-takeover after expired cookies.
Exported-component audit of a consumer Android app
Multiple exported activities and one exported service without caller verification. Cross-app UI hijack demonstrable via a small zero-permission PoC APK that reproduces every finding vector.
Multi-agent desktop environment for internal dev workflows
Desktop app orchestrating specialized agents (planner, researcher, reviewer, executor) in one surface. Task routing, prompt-caching layer, terminal islands, eval suite with CI gate. Cuts manual tool-switch time noticeably.
AI card scanning in a trading-card mobile app
Live camera scanning with auto-focus, bulk ZIP upload up to 100 cards per request, Ximilar Collectibles vision API for recognition and 1-10 condition grading, multi-language support, real-time pricing. From use-case scoping to app-store release.
Rogue-AP awareness test with captive-portal credential capture
Mobile rogue-AP campaign in the office building of a mid-size SaaS company. Captive portal with corporate branding, credential-submit tracking, clean post-test training. Measured: 31 % submit rate on the first run, 6 % after training.
Multi-channel content pipeline with AI images, reels, and auto-posting
Astro-based news CMS with a fully automated daily pipeline: RSS ingestion, Claude-based review batching, fal.ai image generation, ffmpeg reels with TTS voiceover, auto-posting to Bluesky. Runs for months without operator touch.
AI marketplace automation for a B2B hardware shop
Python automation for product onboarding in a niche e-commerce. AI matcher for listing dedup, competitor scraping, automated product enrichment from spec sheets, social distribution via Bluesky. Cuts manual per-product effort from 45 min to 4 min.
Multi-model trading assistant with live charts and eval harness
Next.js 16 app querying five AI providers (Anthropic, OpenAI, Google, Mistral, xAI) in parallel, matching results against TradingView-style lightweight charts, persisted via Supabase. Dashboard with customizable grid layout, eval harness against historical ground truth.
RAG pipeline for internal knowledge bases
Ingestion from Confluence, SharePoint, and Markdown repos. Retrieval tuning with reranking, citation handling. Eval framework keeps hallucination below 1 %.
Ready for a real assessment?
Short scoping call, clear proposal, kick-off in two to four weeks.
Start the conversation