Services / 06

Product & application security

“We need security support in the product team.”

I work with your developers on security reviews, vulnerability triage and fixes. I also set up code and application scanning in CI/CD, and we agree which findings block a release. You end up with findings sorted by what matters, and scanning your team can run without me.

SAST & DAST · CI/CD security gates · Vulnerability management

Who it’s for

  • Startups and small teams Nobody on the team does security full time.
  • Scale-ups The number of developers has grown faster than the security process around them.
  • Teams with a pile of findings You have pentest reports or scanner output and need help sorting them and fixing what matters.
  • Consultancies I can join a client as the AppSec consultant you place there.

What I cover

  • Security reviews Features and designs, reviewed before they ship.
  • Vulnerability triage Scanner output, pentest reports and bug bounty reports, sorted into what matters.
  • CI/CD scanning SAST, dependency (SCA), secrets, container and IaC scanning, and DAST.
  • Release gates Which findings block a release, agreed with your developers.
  • Developer training Secure coding sessions based on your own code and findings.

Platforms: GitHub Actions · GitLab CI · Azure DevOps

Scanners: Semgrep · CodeQL · Trivy · Gitleaks · TruffleHog · Dependabot · Renovate

Frameworks: OWASP SAMM · OWASP DSOMM

How it runs

  1. Scoping & authorization

    What you need, which format fits (fixed project or placement), which repositories and pipelines are involved, the dates and the limits. We also agree whether AI tools may be used on your code and data: local models by default, cloud models only with your written agreement. Signed rules of engagement before I start, and a quote after scoping.

  2. Testing

    Reviews and triage are done by hand, with scanners as support. I work with your developers, in your repositories and pipelines. Critical findings reach you as soon as I find them.

  3. Report & debrief

    Findings with proof, impact and concrete fixes, ranked by risk, then a call with your team. For a fixed project, I also hand over what I set up.

  4. Retest

    Once fixes ship, I verify them and update the report. Evidence stays encrypted and is deleted 90 days after the final report.

What you get

  • Reviewed and prioritized findings What matters first, and why.
  • Help with fixes I work through them with your developers.
  • Scanning in your pipelines Set up with your developers, then handed over.
  • Release gates The rules for which findings block a release, written down.
  • Training sessions When they’re part of the scope, built on your own code and findings.

No public case study for this service yet. See selected work.

Questions

Do you replace a security team?

No. I work with your developers, on a fixed project or a longer placement. What I set up is handed over so your team can run it.

Fixed project or placement: which fits?

A fixed project fits when you know what you need, for example scanning and release gates in your pipelines, handed over at the end. A placement fits when the work will go on for months and needs someone embedded in the team. We decide together at scoping.

Will release gates slow us down?

We agree with your developers which findings block a release. A gate stops a release only for what we decided matters. The rest goes into the backlog, ranked by risk.

Which stack do you support?

For CI/CD: GitHub Actions, GitLab CI and Azure DevOps. For scanning: Semgrep, CodeQL, Trivy, Gitleaks, TruffleHog, Dependabot and Renovate, covering code, dependencies, secrets, containers and infrastructure as code. DAST is in scope too. If your stack is different, tell me and I’ll say whether I can help.

Talk about your project

I reply within two working days. Tell me about your team and your CI/CD platform, what you need help with first, and whether you’re looking for a fixed project or a longer placement. I work remotely by default, and on-site anywhere in France when needed.