Case Studies
We're early-stage, so most of what's here today is self-initiated platform work — built and run the same way we'd build for a client — plus our first real client engagement. As more paid work lands, it's added here with the client's permission.
Internal platform engagement
DevSecOps Bootcamp Platform
- Context
- A Flask application deployed as a real, internet-facing production platform — used as our own proving ground for infrastructure and pipeline patterns before offering them to clients.
- Problem
- Demonstrate that infrastructure and pipeline decisions hold up under an actual security review, not just a local demo.
- Architecture
- Flask app containerized and deployed on Amazon ECS Fargate, behind an Application Load Balancer with ACM-issued TLS 1.3. Networking, compute, logging, and CI/CD resources are all defined in modular Terraform (an AWS CDK implementation of the same platform also exists as a parallel reference).
- Security
- AWS WAFv2 with three managed rule groups in front of the ALB; WAF logs streamed via Kinesis Firehose to a KMS-encrypted S3 bucket. ECS tasks run with a read-only root filesystem. Security groups are egress-restricted rather than default-open. VPC flow logs and Container Insights provide network and runtime visibility. The CI/CD pipeline runs OPA/Conftest policy checks against Terraform plans, plus tfsec and Checkov for IaC scanning, and Bandit, pip-audit, and Trivy for application and container scanning before anything deploys.
- Status
- Not deployed right now, by choice: we tear infrastructure down between active engagements rather than pay to keep a demo environment running 24/7 — the same cost discipline we'd apply to a client's bill. The full source, Terraform, and CI/CD pipeline are public on GitHub for direct inspection, and it redeploys from that same code on request.
- Outcome
- A defensible security posture end-to-end — network, compute, pipeline, and logging — that now serves as the reference architecture we bring into client engagements.
Labeled honestly: this is our own internal platform, not client work. The code is public and inspectable — that's the point, whether or not it's live at this exact moment.
Client engagement
Self-Service Online Store for a Local Food Business
- Context
- A local foodstuff seller needed an online store — browse, cart, checkout — plus the ability to manage her own catalog without calling a developer for every change.
- Architecture
- Flask application with a self-service admin backend (stock/quantity management, product CRUD, delivery settings), session-based cart, and Stripe Checkout for payment — webhook-verified, so payment status is never trusted from a redirect alone.
- Security
- Prices always recomputed server-side at checkout (never trusted from the client), CSRF protection throughout, hashed admin credentials, rate-limited login, Stripe webhook signature verification.
- Outcome
- Full test suite (34 tests) covering payment logic, auth, and tamper-resistance; Bandit and pip-audit clean before first deploy.
Internal tooling
Meeting Transcription & Summarization Automation
- Context
- Manual note-taking during recurring meetings is slow and inconsistent.
- Architecture
- An automated pipeline that ingests meeting audio, produces a transcript, and generates a structured summary — built as a reusable internal tool.
Self-initiated tooling project, not a client deliverable.