[ The workshop / the same for every build mode ]
How I work: a well-run workshop.
One isolated machine per project
Every project runs in its own virtual machine, started only while I work on it. Nothing from one client ever sits next to another's.
Staging first, always
Changes run on a copy of your site before they go anywhere near production.
Deterministic checks on every change
Coding standards, static analysis and tests run automatically. Same code in, same verdict out, every time.
Documentation you keep
Decisions, quirks and why that odd line exists, written down and handed over. You're never locked to me.
Your accounts, your code
Repository, hosting and licenses in your name. I work in them; I don't own them.
Signed off by a person
Every change carries my signature. If it breaks, you know whose phone rings.
- 10+ yearsPHP, WordPress and WooCommerce in production
- Quality gatesSonarQube and coding standards check every change before it ships
- Six Sigma Black BeltScope defined, measured and controlled
- Lean by defaultNo page builders, no bloat: fast pages, less to break
- Zero trackingNo analytics, no third-party CDNs
- Signed commitsEvery change traceable to me, in your repository
[ How it's built / your choice, per project ]
You decide how it's built. I answer for the result either way.
Hand-written
No AI tools touch your code or your data. Traditional craft, line by line.
- Good for
- Strict company policies, sensitive data, or plain preference
- Price
- Quoted next to AI-assisted. You choose.
AI-assisted
AI speeds up the work. Every line is reviewed, tested and signed off by me.
- Good for
- Most builds and modernizations
- Price
- Quoted next to hand-written. Usually faster.
Build policy / summaryFull policy
| Mode | Tools used | Where your data goes | Never |
|---|---|---|---|
| Hand-written | Editor, compiler, linters, test runners. No AI tools; ordinary autocomplete stays on. | My machines and your servers. Nowhere else. | AI tools of any kind, AI code review, AI transcription of our calls. |
| AI-assisted | The above, plus the AI providers named in the AI policy, under the terms set out there. | Code and test data reach the model. Customer records do not. | Production data, passwords, keys, personal data. |
[ Proof / real code, then a real report ]
Real code. Real reports.
A member search from a client's theme, as I found it. The tooling flags two lines. The other two take someone who knows what the business would lose.
add_action("wp_ajax_nopriv_member_search", "member_search");"nopriv" means logged out. No capability check either. Your member list is public.
add_action('wp_ajax_member_search', 'member_search'); function member_search() { $search = $_POST['search_text'];phpcsWordPress.
global $wpdb; // ... 900 lines: pages, agenda, documents ... $users = $wpdb->get_results(" SELECT DISTINCT u.ID FROM {$wpdb->users} u INNER JOIN {$wpdb->usermeta} um1 ON u.ID = um1.user_id INNER JOIN {$wpdb->usermeta} um2 ON u.ID = um2.user_id WHERE (um1.meta_key = 'first_name' AND um1.meta_value LIKE '%{$search}%')phpcsWordPress.
OR (um2.meta_key = 'last_name' AND um2.meta_value LIKE '%{$search}%') "); foreach ($users as $author){ $author_info = get_userdata($author->ID); $telephone = get_user_meta($author->ID,"wpcf-telephone-number"); $user_email = $author_info->user_email;Name, email and phone of every match, for anyone. Search for % and that's every member.
// ... builds the result HTML ... echo $final_html; die;}functions.php, excerpt / real code from a child theme, about 2018 / function renamed, gaps marked
4 findings. 2 from tooling, 2 from reading. Live for years before the refactor.
Security review / AI-built SaaS platformclient anonymized
- 0Critical
- 14High
- 49Medium
- 12Low
Method: deterministic tooling built inventories of the code, one AI model analyzed each candidate finding and a separate one tried to disprove it, and I checked every finding by hand before it went into the report.
| ID | Severity | Finding | Status |
|---|---|---|---|
| F-037 | High | Anyone with the public challenge link could log activity under another participant's name and push them up the leaderboard. | Fixed by client |
| F-007 | High | A customer account labeled "superadmin" was treated as one of your own staff, with power over every other customer's data. | Fixed by client |
| F-058 | Medium | Two AI features worked without logging in, so a stranger could run up your AI bill. | Reported |
3 of 75 findings, worded for the business owner. Status as reported by the client after delivery.