CYBERSECURITY
Prevention, code analysis and audits
Nir works across three areas: risk prevention from day one, static and dynamic code analysis, and targeted audits — application-level or internal. A technical, concrete approach with no unnecessary jargon.
Security isn't added at the end — it's built in from the start
Most vulnerabilities don't come from sophisticated attacks: they come from poorly validated code, a forgotten dependency, a misconfigured access rule. Our approach is to identify these risks early, through analysis and prevention, before they become costly.
- Identify vulnerabilities in the source code before going to production.
- Prevent flaws from day one: architecture, access control, data handling.
- Audit internal systems to surface invisible exposures.
- Analyse third-party dependencies and detect critical CVEs.
- Deliver clear, actionable reports prioritised by severity.
- Support teams in embedding good security practices over time.
What we actually do
Source code analysis
Static and dynamic code review: identification of OWASP Top 10 flaws, injections, XSS, CSRF, exposed secrets and broken application logic.
Application code audit
Full audit of an existing application: critical flow walkthrough, endpoint testing, access control review and authentication policy analysis.
Internal audit
Analysis of internal security posture: rights management, exposed secrets, environment configuration, data access and third-party tool risks.
Prevention by design
Security embedded from the design phase: architecture choices, access policies, data validation, threat modelling and risk surface mapping.
Dependency analysis
Detection of vulnerable libraries and packages (CVE), automated scanning with Trivy and Snyk, update strategy and continuous alerting.
API security
Review of exposed endpoints: input validation, JWT/OAuth2 token handling, rate limiting, access control and error exposure management.
Our analysis and audit tools
OWASP ZAP and Burp Suite for application analysis, Nmap and Metasploit for network reconnaissance, Trivy and Snyk for dependency scanning — on Kali Linux or directly in your environment.
+20 cybersecurity tools mastered
Situations where we step in
AI security: specific risks
Applications integrating language models expose new attack vectors: prompt injection, data exfiltration via LLM responses, guardrail bypasses. We incorporate these specifics into our security reviews for AI projects.
Our engagement formats
Code analysis
Static and dynamic source code review. Deliverable: report of identified vulnerabilities, ranked by severity, with concrete examples and remediation recommendations.
Application audit
Full audit of a production or in-development application: flow walkthrough, endpoint testing, access control review and security posture assessment.
Internal audit
Analysis of internal systems: rights and secrets management, environment configuration, access to sensitive data and third-party exposure risks.
Prevention support
Security embedded from the design of a new project: architecture review, library selection, threat modelling and ongoing best practices guidance.
Have a project in mind?
A project to build, a process to automate, a mobile app to launch: let's talk. No commitment, just a conversation.