krobins.dev

What I take on

Services

Five things I am happy to be hired for. Pick the one that fits, or get in touch if you are unsure which it is.

  1. Service

    Magento security audits

    A focused security review of a Magento 2 or Adobe Commerce store, for merchants who want to know exactly where they stand before the next bad week.

    What is included

    • Patch level review against Adobe security bulletins, plus a patch ordering plan if you are behind
    • Custom module and third-party extension audit, diffed against vanilla and against the last known-good state
    • Admin, REST, GraphQL, and integration surface review, including headless and admin separation
    • Prioritised written report with concrete remediation steps, not a generic checklist

    Engagement

    Fixed-scope audit, typically one to three weeks depending on store size and extension footprint. Delivered as a written report with a follow-up call to walk through findings. Optional retainer for Patchwatch advisory tracking and monthly patch review.

  2. Service

    Ecommerce builds and optimisation

    New stores or rescuing the one you have. Shopify, WooCommerce, headless commerce, and Magento. Same approach throughout: make it fast, make it reliable, make it convert.

    What is included

    • Platform selection and architecture, including honest advice when you are on the wrong one
    • Checkout, catalogue, and PDP work, with conversion and Core Web Vitals as first-class concerns
    • Integrations with PIM, ERP, payment, search, and tax providers, built to fail safely
    • Headless front ends in Next.js against Magento, Shopify, or a commerce API of your choosing

    Engagement

    Fixed-scope project for defined builds, or an ongoing monthly retainer for stores that need steady hands rather than a one-off push. Day rate available for short interventions.

  3. Service

    General web development

    Marketing sites, internal tools, and full-stack apps in Next.js, TypeScript, and Node. New builds, and rescues of projects that have drifted.

    What is included

    • Next.js, TypeScript, and Node app development, server-rendered by default and boring on purpose
    • Design-system implementation against an existing brand, or a sensible starting point if you have none
    • CI, deploys, and infrastructure setup that you can hand to a junior without it falling over
    • Handover documentation, pairing sessions, and a clean exit so you are not stuck with me

    Engagement

    Day rate for ongoing work and rescues. Fixed scope for well-defined projects. I am happy to work as part of an existing team or solo.

  4. Service

    Security audits for general web apps

    A pragmatic security review for any web application, not only ecommerce. Designed to give you a clear, prioritised list of things to fix, not a 200-page PDF nobody reads.

    What is included

    • Threat model review against how the app is actually used, not how the architecture diagram says it is
    • Authentication, session, and authorisation review, including the boring parts like password reset and email change flows
    • Input validation, injection surface, secrets handling, CORS, CSP, and dependency review
    • Post-incident triage when something has already gone wrong, with a written timeline and remediation plan

    Engagement

    Fixed-scope audit with a written report and a follow-up call. Post-incident work is hourly with a clear cap agreed up front, because nobody wants a meter running during a fire.

  5. Service

    Honest second opinion on your vibe-coded app

    Built it fast with Cursor, Claude, v0, Lovable, or Bolt? Before real customers touch it, I audit it for the patterns the LLM forgot.

    What is included

    • Auth and authorisation gaps, missing input validation, and server actions that trust client state
    • Secrets exposed in client bundles, unsafe CORS, and over-permissive API routes
    • Hallucinated APIs, dependencies pulled in without vetting, and the usual database-write-on-GET surprises
    • Production readiness pass: logging, error handling, rate limits, and a sober look at what scales and what does not

    Engagement

    Two-week fixed-price engagement with a written report and a prioritised fix list. Optional fix-it follow-up where I land the high and medium severity items myself, so you are not left translating findings into pull requests.