Business web apps, websites, internal tools and new products. Every price on this page.
It does not exist yet
Custom web application development, business websites, API development and the first version of a new product. You get the repository, the pipeline and the documentation, and it ships running rather than nearly running.
See what building costsIt works, but it costs the team time
Business process automation and internal tools. The deploy that eats an evening, the spreadsheet somebody rebuilds every Monday, the outage your customers report before you notice. Ranked by hours saved per month.
See what improving costsIt is live and you are worried
Application security audits and code review. What an attacker sees, where your keys live, what one codebase actually gets wrong, and where your users get stuck. Findings ranked by business impact, each with the fix written out.
See what reviewing costsMost people who build software have never attacked any. Most people who attack it have never had to ship. I do both.
Services & Prices
Every price is days × day rate
€350 – 550 per day
Ranges are honest, not anchors. The scope call turns a range into one number, and that number goes in the written brief before anything starts.
Dependency and security updates, certificate and backup checks, uptime monitoring, and a person who already knows your system when something breaks.
Booked days inside your team, your board and your standups. For when the work is continuous and a fixed scope would only get in the way.
Both are kept out of the scope builder on purpose. A monthly retainer and a day rate are not project costs, and adding them to a project total would only make the number wrong.
What you have, what you need, and what a good outcome looks like. If I am the wrong person, I say so on this call.
What is being built, improved or tested, what is explicitly out of scope, the timeline, the price and who decides. Security work includes signed authorization.
Weekly written updates on builds, a halfway update on reviews. Anything critical reaches you the hour I find it.
Builds ship running, with the repository, pipeline and documentation in your hands. Reviews ship as a report ranked by business impact, each finding with the fix written out.
A handover for builds, a findings walkthrough for reviews, while the context is still fresh in both our heads.
Fixes on anything I built that does not behave as agreed. For reviews, a free retest of every finding you fix inside that window.
2024 – 2026
Founding engineer, from an empty repository to paying merchants. I built the API security, the multitenancy, and the GDPR privacy work that came with holding other companies’ customer data. Isolation was a database per tenant. It kept merchants apart, but it did not carry schema migrations cleanly across all of them, and that is the piece I would design differently now.
2025
Scans IP ranges, detects open services, extracts version information, and flags end-of-life software and known CVEs. I wrote it, so the exposure assessment I sell is not a rented tool with my name on the report.
2023
Vera Connect. A social platform where you decide, per person, which parts of your data they get to see: phone number, address, date of birth, contacts. Shipped and live with real users on it. I did the privacy hardening and ran the database migrations against it in production. An end-to-end encryption prototype sat on top of that, built to test whether the model held.
2025 – 2026
MSc thesis. Analyses RIPE Atlas probe traffic to detect national outages and then validate that what the data shows actually happened.
Now
Secrets rotation and handling, leak detection, identity and access management, secrets cryptography, and the site reliability side of keeping all of it running.
Retainers and booked days are priced separately and are not part of this total.