Security pass
MembersThe security review you can commission without being able to read the code.
/security-pass
- Nine checks: secrets, injection, sign-in, access, validation, dependencies, headers, rate limits, exposure.
- Covers prompt injection on anything with AI in it, and searches your git history for keys you thought you removed.
- Fixes with a test per fix, mapped to the OWASP Top 10, ending in a PASS for a named audience.
QA pass
MembersProves the thing works for a real person, on a real phone.
/qa-pass
- Names your critical paths, the few things that make the product worthless if they break, and tests each one.
- Drives a real browser at desktop width and at 390 pixels, and captures the screenshots.
- Checks empty, loading, error and success on every screen, then says ship or do not ship.
Launch checklist
MembersThe twelve things people forget the day before they launch.
/launch-checklist
- Domain, HTTPS, SEO basics, social preview, sitemap, analytics and the legal pages.
- Forms that actually arrive, and SPF, DKIM and DMARC so your mail does not land in spam.
- Backups with a tested restore, monitoring, and a one-page runbook for you in six months.
Data safety
MembersKeeps you from losing or leaking the records your business runs on.
/data-safety
- Append-only migrations, so a change to how data is stored never takes records with it.
- A real restore drill, because a backup nobody has ever restored is a rumour.
- Per-action approval on anything that writes to the live database, in plain words, before it runs.
Copy pass
MembersMakes every word sound like you, not like software.
/copy-pass
- Plain words, no hype, and one call to action per screen instead of four equal buttons.
- One name per thing everywhere, including the code, the screens and the emails.
- Error messages that say what to do next, and link text that still makes sense read aloud.
Brand kit in an hour
MembersA name check, a palette, type, a mark, and the files a website actually needs.
/brand-kit-in-an-hour "Harbour Lane Bookkeeping"
- Checks the name against domains, business registries and social handles before you fall in love with it.
- Builds a palette with every contrast pair measured, and a type pairing that is free to use commercially.
- Writes the image-model prompt for the mark, then the favicon, the social image and a tokens file.
App in an afternoon
MembersFrom an idea to a deployed app with sign-in, a database, and one thing that works.
/app-in-an-afternoon "track which grants we have applied for"
- Scopes you to one feature and writes everything else on a later list you can see.
- Deploys an empty app first, so deployment is never what breaks at the end, then adds sign-in and the database.
- Finishes by running ship-review, so you know whether it is safe to show anyone.