Exposure review
Services, ports, DNS, reverse proxies, HTTP headers, certificates, accounts and administrative access paths.
SECURITY / HARDENING
Security grounded in how your system actually works.
I analyse service exposure, system and application configuration, scan results and access paths. Recommendations aim to reduce risk without accidentally cutting off production.
- Coverage
- Host, network, application
- Method
- Risk before checklists
- Changes
- Tested and reversible
APPROACH
Hardening without context can be as dangerous as no hardening at all.
A scanner's list of recommendations does not show the whole picture. The same vulnerability can have a different priority depending on exposure, data, compensating controls and the service's role in the environment.
First, I establish the attack surface, traffic flows, accounts and permissions, the update process and recovery options. Only then do I select the changes and their order.
Every significant modification should have a test, a deployment window and a rollback plan. The aim is measurable risk reduction, rather than the largest number of ticked boxes.
AREAS OF EXPERTISE
Areas I combine in one project.
The scope follows your goal and the current state of the environment. We can start with a single issue or a complete project.
System hardening
SSH, firewalls, permissions, updates, containers, secrets, logging and restricted capabilities.
Scan analysis
Verification of vulnerabilities, elimination of false positives, impact assessment and a remediation plan ordered by risk.
Deployment security
CSP, rate limiting, HSTS, form protection, host validation, data minimisation and safe rollback.
WHAT YOU RECEIVE
What you receive beyond the configuration.
A deployment should be verifiable, maintainable and safe to develop further.
- 01
A map of exposure and the most important system access paths.
- 02
Findings with priorities, impact and recommended fixes.
- 03
Hardening changes to system, reverse proxy or container configuration.
- 04
Tests confirming the fix is effective and has not caused functional regressions.
- 05
A maintenance plan covering updates, log retention, reviews and responsibilities.
HOW I WORK
From context to controlled deployment.
- 01
Context
I establish the data involved, exposure, service criticality and operational constraints.
- 02
Verification
I check findings manually and compare them with the actual configuration.
- 03
Priorities
I order actions by risk, cost and likelihood of regression.
- 04
Remediation
I implement or describe fixes, including a test and a rollback method.
WHEN IT HELPS
This service makes sense when…
You do not need a finished specification. A specific problem, risk or desired outcome is enough.
- You have a scanner report and need a practical remediation plan.
- A production server has a legacy configuration and many exposed services.
- You want to deploy Docker while retaining control of the firewall and SSH access.
- An application needs security headers, rate limiting and form protection.
- You need to document risks and the order of changes before a customer audit.
Linux
Nginx
TLS
CSP
Firewall
Docker security
Nessus
Fail2ban
SSH
OWASP
RELATED WORK
See how these skills come together in a working project.
CYBERSECURITY / AI / EVIDENCE
AISeeRisk
A security audit platform combining an authorised scope, reliable evidence, risk prioritisation and controlled remediation with subsequent verification.
Read the case study →
MONITORING / OBSERVABILITY
UPnator
A monitoring and reliability platform for websites, APIs, servers, databases and telephony, with alerts, status pages, incident history and SLO reports.
Read the case study →
EVENTS / ORGANIZER PLATFORM
Eventnado
A two-sided event platform combining a catalogue and search for attendees with planning, administrative requirements, registration and event operations for organisers.
Read the case study →
AI / VOIP / COMMUNICATION PLATFORM
Callchestra
A business communication orchestration platform combining AI agents, PBX, routing, workflows, call analytics and integrations in one controlled environment.
Read the case study →
VOIP / COMMUNICATION PLATFORM
RelayPBX
A platform for building and operating business telephony, combining visual configuration, routing, tenants, SIP diagnostics and different deployment models.
Read the case study →
COMMUNITY / AUTOMOTIVE
Pokaż Brykę
A community for car projects with vehicle profiles, modification histories, rankings, categories, a Spotted module and engagement features.
Read the case study →
HEALTHCARE / BOOKING
Psycholog Spektrum
A psychology practice website combining a calm presentation of its services, appointment booking, contact forms and tools for everyday administration.
Read the case study →FAQ
Common questions before we start.
Is a scanner result alone enough to implement fixes?
Not always. The result needs verification, exposure and dependencies need checking, and regression risk needs assessment. An automated list does not know the full production context.
Can hardening cut off access to a server?
Yes. That is why SSH, firewall and network changes require a second session, tested emergency access and a staged rollout.
Do you perform penetration tests?
The focus is on configuration reviews, exposure analysis, verification of scan results and remediation. A full offensive penetration test requires a separately agreed scope and rules.
How do you handle data from forms and logs?
Only data needed for the service is collected. Logs and messages should not contain additional information unless it is necessary for diagnostics or handling an enquiry.
NEXT STEP
Have a vulnerability report or an environment you are reluctant to change?
Let's establish exposure, priorities and a safe order of changes. We address the largest risks first, then work through the rest.