Alfred Seguridad Digital

Independent cybersecurity consulting

I review your code and APIs, investigate incidents, and fix what I find.

I am a self-employed defensive security consultant. I work for businesses of any size, on systems they own, under written authorization.

Email me See services

Services

  1. Source code review

    I read the application's code and look for security flaws in input validation, session handling, secrets, cryptography and dependencies. Each finding names the file, the line and the fix.

  2. API security

    I check authentication, access control and input validation on every endpoint, REST or GraphQL. I test what a user can do with data that belongs to someone else.

  3. Business logic and authorization

    A customer who can open another customer's order, or a discount that applies twice, are flaws automated scanners do not detect. I look for them by hand, following the application's real flows.

  4. Vulnerability assessment

    I list what the company exposes to the internet and its known flaws. I rank them by the damage each one would cause, so you know what to fix first.

  5. Security architecture

    I review a system's design before it is built or once it is in production. I look at environment separation, identities and permissions, secrets, backups and event logging.

  6. Log analysis and attacker behavior

    I read your server and application logs to tell routine noise from an attack in progress. I reconstruct what the attacker was after and how far they got.

  7. Incident investigation

    If something has already happened, I establish how they got in, what they touched and which data was affected. I deliver a written timeline.

  8. Mitigations

    When you authorize it, I apply the fixes on your systems myself, whether patches, access rules or configuration changes. Then I check that the flaw can no longer be exploited.

How I work

  1. Scope

    We talk about which systems you want reviewed and what worries you. I send a proposal with the scope, the timeline and the price.

  2. Authorization

    Before I touch anything, we sign which systems are in scope, on which dates and within which limits. I only work on systems you own.

  3. Review

    I review, test and document. If I find something serious I tell you the same day, without waiting for the report.

  4. Report

    Each finding explains how to reproduce it, what its impact is and how to fix it. Findings are ordered by severity.

  5. Fix and retest

    Your team fixes the flaws or I fix them. Then I test each one again.

Who it is for

I work with businesses of any size and sector. These are the most common cases.

  • A software company that wants a review before launching a product.
  • An online shop or platform that stores customer and payment data.
  • A development team with no security lead that needs an outside opinion.
  • A company that has had an incident and needs to know what happened.

Working terms

  • Defensive work only. I do not take engagements on third-party systems or without the owner's authorization.
  • Confidentiality. I share nothing I see on your systems, and no findings, with anyone.
  • Direct contact. You always talk to the person doing the work.

Contact

Tell me what you need reviewed. I reply in English or Spanish.

hola@alfred.casa