Software & Cybersecurity Architect

See what a code review finds.

An API code review, from finding to fix.

Read the sample review

Web development
Applications
Automation
MQL4/MQL5 development

Keep report access within its workspace

Synthetic API review GET /api/reports/{reportId}

Workspace A

Reader

Workspace B

Report

No workspace
check

A report lookup by ID alone can cross the workspace boundary.

Sample finding

Proposed fix

Verify that the report belongs to the requester’s workspace before returning it.

Resolve the workspace from the authenticated caller’s membership, require report read permission, and query by both workspace ID and report ID.

See the suggested query

const workspace = requireWorkspacePermission(
  session,
  "reports:read"
);

const report = await reports.findOne({
  id: reportId,
  workspaceId: workspace.id
});

if (!report) return notFound();

Regression checks

A reader requests a report in their workspace.200 OK
A reader requests a report in another workspace or an unknown ID.404 Not Found
A workspace member without report read permission requests a report.403 Forbidden

Expected responses for the proposed tests.

High priority / Object-level authorization

The example route checks permission in the caller’s workspace, then fetches the report by ID alone. A caller who knows a report ID from another workspace can read that report. Return the same 404 for unknown and out-of-scope IDs.

What I look for

Permissions and data isolation
Input validation and error handling
Exposed data and secrets
Maintainability and regression coverage

Services

API code review

I review a pull request or a defined API change and explain what to fix first, how to fix it, and which tests to add.
Web development

I build responsive websites and landing pages, multilingual if needed and with technical SEO.
Web and desktop applications

I build web and desktop applications such as internal tools, dashboards, or programs that connect to APIs. They work without AI, or I add AI features like document analysis, summaries, or an assistant.
Security automation

I add security checks to your CI/CD pipeline: code analysis, dependency and secret scans, and regression tests for access control. Your team gets the results as a prioritized report.
AI and workflow automation

I automate recurring tasks with Python and AI models, such as analyzing and sorting documents, emails, or tickets and syncing data between tools. Important decisions stay with your team.
MetaTrader development

I develop, fix, port, and test Expert Advisors for MT4 and MT5 in MQL4 and MQL5. The work is based on your rules and does not include investment advice or signals.