# geearr — Break it before they do.

> geearr is the security practice of George Rios: hands-on penetration testing, application security, email security (DMARC, SPF, DKIM, BEC) and cloud security, plus security audits of AI-built apps and LLM agents. US-based, works remotely with finance, healthcare, insurance and SaaS teams.

George Rios (“geearr”, from his initials G.R.) is a hands-on security engineer and fractional CTO with 25 years of experience shipping enterprise systems — most recently Tech Lead and interim CTO at Catch Health, a health-insurance marketplace serving 400K+ members. He builds security products (identity, communication provenance, consent and tamper-evident audit) and tests other people’s systems the way an attacker would: read the code, exercise the system, prove the impact, and help fix what matters.

## Services

- **[Penetration Testing](https://geearr.com/services/penetration-testing)** — A penetration test is a time-boxed, hands-on attack on your systems by a human tester, with permission, to find and prove exploitable weaknesses before a real attacker does. geearr tests web apps, APIs, external perimeter and cloud, and every finding ships with evidence, a fix and a retest.
- **[Application Security](https://geearr.com/services/application-security)** — Application security (AppSec) is the practice of finding and preventing vulnerabilities in the software itself — its code, architecture, identity flows and build pipeline. geearr does manual secure code review, threat modeling and OAuth/OIDC review, then leaves guardrails in your CI so the bugs do not come back.
- **[Email Security](https://geearr.com/services/email-security)** — Email security consulting stops attackers from impersonating your domain and your people. geearr takes domains from “anyone can spoof us” to DMARC p=reject without breaking legitimate mail, hardens transport with MTA-STS, and builds BEC and payment-fraud controls around the humans.
- **[Cloud Security](https://geearr.com/services/cloud-security)** — A cloud security assessment reviews how your AWS, Azure, GCP or Cloudflare accounts are configured — identity, exposure, data, secrets and logging — and traces the realistic paths an attacker would take. geearr turns that into a short, prioritized fix list instead of thousands of alerts.
- **[AI & Vibe-Coded App Security](https://geearr.com/services/ai-app-security)** — An AI-built app security audit checks software generated with AI coding tools for the mistakes those tools commonly make — exposed secrets, missing authorization, open databases — and reviews LLM agents for prompt injection and over-broad tool access. geearr delivers a fix-first list sized for a small team.

## How an engagement works

01. **scope** — Free 30-minute call: targets, rules of engagement, and what “done” looks like. Clear scope and quote up front.
02. **recon** — Map the real attack surface — code, endpoints, identities, cloud accounts, mail flows — including what nobody documented.
03. **exploit** — Hands-on testing that chains weaknesses into proven impact. Safe, controlled, coordinated with your team.
04. **report** — Findings with evidence, severity and fixes. Written for engineers, summarized for leadership and auditors.
05. **retest** — Patches written or reviewed with your team. Every fixed finding is retested and confirmed closed.

## Security products shipped

- **[Fromenance](https://fromenance.com)** — Communication provenance for banks, credit unions, insurers and utilities. Institutions register each outbound message at send time; customers ask “did you really send this?” and get Verified, Not verified or Known fraud. Failed checks become threat samples exportable as STIX 2.1 — closing the gap SPF, DKIM and DMARC leave open.
- **[Engrave](https://tryengrave.com)** — The black box recorder for AI agents. Immutable audit evidence: RFC 6962 Merkle proofs against an Ed25519-signed tree head, witnessed hourly and RFC 3161-timestamped, verified client-side. Per-tenant keys and sequencers; an MCP layer records agent tool calls as a tamper-evident, hash-linked trace.
- **[Identizen](https://identizen.com)** — Accountless identity. Biometric sign-in approved on your phone, delivered to apps as standard OpenID Connect tokens. Per-site derived keys prevent cross-site tracking; single-use 60-second challenges with match codes block relay attacks; the index stores no secrets.
- **[AuthnzNet](https://authnz.net)** — OAuth 2.0 + OIDC server in three commands. A free .NET tool that runs a standards-compliant OAuth 2.0 / OpenID Connect server: RS256 signing with auto-generated RSA-2048 keys published via JWKS, PKCE (S256), login UI and .well-known discovery.
- **[PRYVC](https://pryvc.com)** — OAuth for contact details. A consent protocol: people approve which contact fields a business may use, for what purpose and how long — and revoke with one click. Envelope encryption with no staff decryption path, plus a hash-chained, append-only audit log with publicly verifiable consent certificates.

## Guides

- [How to get DMARC to p=reject without breaking email](https://geearr.com/guides/dmarc-p-reject-rollout) — A step-by-step DMARC enforcement rollout: inventory senders, fix SPF’s 10-lookup limit, align DKIM, move from p=none to quarantine to reject, and lock down parked domains.
- [Penetration test vs. vulnerability scan: what’s the difference?](https://geearr.com/guides/pentest-vs-vulnerability-scan) — How penetration tests and vulnerability scans differ, what scanners cannot find, which one PCI DSS 4.0, SOC 2 and HIPAA expect, and what a good pen test report contains.
- [Security checklist for AI-built (vibe-coded) apps](https://geearr.com/guides/ai-built-app-security-checklist) — A practical pre-launch security checklist for apps built with Cursor, Claude, Lovable, Bolt or v0: secrets in bundles, Supabase RLS, server-side authorization, environments, backups and LLM agent risks.
- [OAuth 2.0 & OpenID Connect security review checklist](https://geearr.com/guides/oauth-oidc-security-review) — An OAuth 2.0 / OIDC security checklist based on RFC 9700: PKCE everywhere, exact redirect URI matching, strict JWT validation, token storage, refresh token rotation and sender-constrained tokens.

## FAQ

### Who is George Rios (geearr)?

George Rios — “geearr”, from his initials G.R. — is a US-based security engineer and fractional CTO with 25 years of experience building enterprise systems in financial services, healthcare, insurance, SaaS and logistics. Through geearr he offers penetration testing, application security, email security, cloud security and AI-application security audits, and he builds security products including Fromenance, Engrave, Identizen, AuthnzNet and PRYVC.

### What industries do you work with?

Mostly regulated and high-trust industries: banks and credit unions, insurance, healthcare, fintech, SaaS and logistics. Engagements are often driven by SOC 2, HIPAA, PCI DSS, GLBA or cyber-insurance requirements, and reports are written so they can be shared with auditors and underwriters.

### What do I get at the end of an engagement?

A written report with an executive summary, technical findings with evidence and severity, prioritized remediation guidance, a live readout with your team, and a retest of fixed issues. Where it helps, George also writes patches, configures CI/CD guardrails or applies DNS and cloud changes directly.

### How do I start a security engagement with geearr?

Book a free 30-minute scoping call at https://cal.com/georgerios/30min or email george@georgerios.com. You will get a clear scope and quote before any testing begins.

### What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated: it matches software versions and configurations against known issues and produces a long, noisy list. A penetration test is performed by a human who validates findings, chains weaknesses together, tests business logic, and demonstrates real impact. Scans are useful hygiene; a pen test tells you what an attacker could actually do.

### Do I need DMARC set to p=reject?

If you want to stop attackers from spoofing your exact domain, yes. A DMARC policy of p=none only monitors; it does not protect anyone. Google, Yahoo and Microsoft already require DMARC for bulk senders, and p=reject is the goal for any domain your customers trust. The safe path is a staged rollout that inventories every legitimate sender first.

### Is code generated by AI tools secure?

Not by default. AI coding assistants frequently produce working code with missing authorization checks, secrets embedded in front-end bundles, permissive database rules and outdated or non-existent dependencies. The code may function perfectly while exposing every customer record. An independent security review before launch is strongly recommended.

## Contact

- Email: george@georgerios.com
- Book a free 30-minute scoping call: https://cal.com/georgerios/30min
- LinkedIn: https://linkedin.georgerios.com
- X: https://x.com/riosgeorge

---
Canonical: https://geearr.com/ · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt