I check whether software is actually safe. That’s the job.

For 11+ years I’ve worked on real-money systems — platforms where a payment that half-completes is not a bug report, it is somebody’s money sitting in nowhere. On systems like that you stop asking “does it work?” very early, because the answer is almost always yes, and it tells you almost nothing.

The questions that matter are different. What happens when the process dies mid-payout? What happens when the same event is delivered twice? What happens when four million automated requests find the login form in a week? Those have answers, and the answers are artifacts — tests, review verdicts, invariants, reconciliation reports. Not opinions.

The moment this became a product

I watched a feature that was “ready to ship” collect four separate NO-GO verdicts. Nobody on that team was careless. They had tested it end to end and everything they tried worked. What they hadn’t done — because almost nobody does — was attack it: kill the process mid-transaction, deliver the same event twice, restart the job halfway. Every round found a different class of failure. The last three bugs only appeared on staging, and one of them would have leaked free money on launch day.

Around the same time, founders kept asking me the same question in different words: “My developer says it’s done. How would I know?” They weren’t asking me to read their code. They were asking for the questions — the ones that make a technical answer either specific or obviously vague. Nobody had ever given them those.

Why now

Building software got dramatically cheaper. Anyone can produce a working screen this year, and the apps that come out of AI builders look finished — which is exactly the problem, because what is usually missing is invisible from the outside. Rate limiting. Key handling. Payment failure paths. Who owns the account everything runs on.

AI made building cheap. Verifying is now the skill. That is the whole thesis of this site. The scarce skill is no longer producing software; it is knowing whether what you produced or paid for will survive contact with real users, real money and the open internet.

What I will and won’t do here

Everything I publish is anonymized — no client names, no hostnames, no screenshots. The patterns are real and the numbers are exact; the identities are gone and stay gone. If you hire me for a review, your project gets the same treatment.

I will not tell you your developer is ripping you off. Most aren’t. I will give you the questions that make the answer obvious either way, and where it helps, the evidence itself.