Service specification
Web development
Customer portals, internal systems, APIs and admin panels that withstand realistic abuse scenarios.
§01
Architecture
We start with a role matrix: who can see and change what. Every permission check runs on the server; the interface only reflects what is already allowed.
§02
Baseline protection
| Threat | Control |
|---|---|
| Injection | Parameterised queries, schema validation on input |
| XSS | Escaping by default, Content-Security-Policy |
| CSRF | SameSite cookies, tokens for state-changing requests |
| Password guessing | Rate limiting, back-off, optional 2FA |
| Session leakage | httpOnly, Secure, rotation after login |
§03
Operations
Server rack with network equipment. Source: Server rack filled with network and electronic equipment · Unsplash License
- Logs without personal data, with correlation IDs.
- Backups with a tested restore.
- Deployment instructions your own team can follow.
§04
Tolerances
LCP ≤ 2.5 s
WCAG 2.2 AA contrast and keyboard navigation
API documentation for every endpoint