Selected work

Situation: a client business whose platform serves many end-client accounts needed its backend built with access as the foundation: who sees what, how new people get provisioned, and how the system stays safe as the team grows.

Risk: without isolation and role controls, any staff account could reach any client's data, and departures left credentials and access behind.

Scope: the platform's entire access layer: department-scoped, fail-closed role-based access control, per-tenant isolation enforced in the database, encrypted storage for third-party integration credentials, secret scanning on every code change, and provisioning and offboarding workflows.

Result: each staff member can reach only the client accounts their role requires. New staff get the right access by role, departures are closed out by workflow, and client data is isolated per tenant. This engagement is why VXSec's agency offer treats workflows and access as one system.

Situation: a support-services organization had grown its Google Workspace organically: personal Drive folders doing the work of shared infrastructure, ad-hoc sharing, and no consistent way to grant or remove access by role.

Risk: company records lived in personal accounts, so a single departure could strand files, and nobody could say who had access to what.

Scope: department-based Shared Drive architecture, role-based access through Google Groups, defined permission tiers, file ownership cleanup, and provisioning workflows.

Result: joiners and leavers now get the right access by default instead of by memory, and ownership of company records sits with the company.

Situation: a QuickBooks to Mailchimp integration kept breaking. OAuth tokens expired without refreshing, token state was not persisted reliably, and customer syncs failed silently.

Risk: marketing lists drifted out of date without anyone noticing, and the failure mode was invisible until a campaign went out wrong.

Scope: OAuth token handling end to end: persistence, refresh logic, failure handling, and customer sync reliability across Heroku and Supabase infrastructure.

Result: the integration runs reliably with failures surfaced instead of silent. The same failure patterns show up constantly in Zapier, Make, and n8n stacks, which is why VXSec treats automation ownership as a security problem, not just a reliability one.

Situation: a production PHP Laravel application and its SQL data needed to move from Azure to OVH without extended downtime, and the surrounding server estate needed a security review as part of the move.

Risk: a botched cutover meant downtime for a live business; an unexamined estate meant carrying old configuration debt into the new environment.

Scope: application and database migration, SSL configuration with Certbot, DNS updates, Windows VM replication, and Linux and Windows security policy review.

Result: the application moved without extended downtime and the estate was reviewed on the way. Migration is when access and configuration debt surfaces, and cleaning it up during the move is far cheaper than after.