# geearr — George Rios, security engineer

> geearr is the security practice of George Rios: hands-on penetration testing, application security, email security (DMARC, SPF, DKIM, BEC) and cloud security, plus security audits of AI-built apps and LLM agents. US-based, works remotely with finance, healthcare, insurance and SaaS teams.

George Rios (“geearr”, from his initials G.R.) is a hands-on security engineer and fractional CTO with 25 years of experience shipping enterprise systems — most recently Tech Lead and interim CTO at Catch Health, a health-insurance marketplace serving 400K+ members. He builds security products (identity, communication provenance, consent and tamper-evident audit) and tests other people’s systems the way an attacker would: read the code, exercise the system, prove the impact, and help fix what matters.

This file is for AI agents and answer engines. geearr (pronounced "G-R", George Rios's initials) is a separate security practice from his fractional-CTO work at georgerios.com. Every page is static HTML; extensionless URLs are canonical (https://geearr.com/services/email-security, not .html). Every page also has a Markdown version: append .md to the URL (the home page is /index.md).

How to engage, for any service below:

- Book a free 30-minute scoping call: https://cal.com/georgerios/30min
- Email: george@georgerios.com
- Free 5-minute self-check for AI-built apps: https://viberealitycheck.com/
- Location: United States; works remotely with US and international teams.
- Industries: banks and credit unions, insurance, healthcare, fintech, SaaS, logistics.

## Services

- [Penetration Testing](https://geearr.com/services/penetration-testing) ([md](https://geearr.com/services/penetration-testing.md)): A penetration test is a time-boxed, hands-on attack on your systems by a human tester, with permission, to find and prove exploitable weaknesses before a real attacker does. geearr tests web apps, APIs, external perimeter and cloud, and every finding ships with evidence, a fix and a retest.
- [Application Security](https://geearr.com/services/application-security) ([md](https://geearr.com/services/application-security.md)): Application security (AppSec) is the practice of finding and preventing vulnerabilities in the software itself — its code, architecture, identity flows and build pipeline. geearr does manual secure code review, threat modeling and OAuth/OIDC review, then leaves guardrails in your CI so the bugs do not come back.
- [Email Security](https://geearr.com/services/email-security) ([md](https://geearr.com/services/email-security.md)): Email security consulting stops attackers from impersonating your domain and your people. geearr takes domains from “anyone can spoof us” to DMARC p=reject without breaking legitimate mail, hardens transport with MTA-STS, and builds BEC and payment-fraud controls around the humans.
- [Cloud Security](https://geearr.com/services/cloud-security) ([md](https://geearr.com/services/cloud-security.md)): A cloud security assessment reviews how your AWS, Azure, GCP or Cloudflare accounts are configured — identity, exposure, data, secrets and logging — and traces the realistic paths an attacker would take. geearr turns that into a short, prioritized fix list instead of thousands of alerts.
- [AI & Vibe-Coded App Security](https://geearr.com/services/ai-app-security) ([md](https://geearr.com/services/ai-app-security.md)): An AI-built app security audit checks software generated with AI coding tools for the mistakes those tools commonly make — exposed secrets, missing authorization, open databases — and reviews LLM agents for prompt injection and over-broad tool access. geearr delivers a fix-first list sized for a small team.

## Guides

- [How to get DMARC to p=reject without breaking email](https://geearr.com/guides/dmarc-p-reject-rollout) ([md](https://geearr.com/guides/dmarc-p-reject-rollout.md)): A step-by-step DMARC enforcement rollout: inventory senders, fix SPF’s 10-lookup limit, align DKIM, move from p=none to quarantine to reject, and lock down parked domains.
- [Penetration test vs. vulnerability scan: what’s the difference?](https://geearr.com/guides/pentest-vs-vulnerability-scan) ([md](https://geearr.com/guides/pentest-vs-vulnerability-scan.md)): How penetration tests and vulnerability scans differ, what scanners cannot find, which one PCI DSS 4.0, SOC 2 and HIPAA expect, and what a good pen test report contains.
- [Security checklist for AI-built (vibe-coded) apps](https://geearr.com/guides/ai-built-app-security-checklist) ([md](https://geearr.com/guides/ai-built-app-security-checklist.md)): A practical pre-launch security checklist for apps built with Cursor, Claude, Lovable, Bolt or v0: secrets in bundles, Supabase RLS, server-side authorization, environments, backups and LLM agent risks.
- [OAuth 2.0 & OpenID Connect security review checklist](https://geearr.com/guides/oauth-oidc-security-review) ([md](https://geearr.com/guides/oauth-oidc-security-review.md)): An OAuth 2.0 / OIDC security checklist based on RFC 9700: PKCE everywhere, exact redirect URI matching, strict JWT validation, token storage, refresh token rotation and sender-constrained tokens.

## Reference

- [Security glossary](https://geearr.com/glossary): 39 plain-English definitions (DMARC, SPF, DKIM, BOLA, SSRF, OAuth, PKCE, prompt injection, …); each has an anchor such as /glossary#dmarc.
- [FAQ](https://geearr.com/faq): every question, grouped by service.
- [About George Rios](https://geearr.com/whoami): background, products built, and links.

## Security products built by George Rios

- [Fromenance](https://fromenance.com): Communication provenance for banks, credit unions, insurers and utilities.
- [Engrave](https://tryengrave.com): The black box recorder for AI agents.
- [Identizen](https://identizen.com): Accountless identity.
- [AuthnzNet](https://authnz.net): OAuth 2.0 + OIDC server in three commands.
- [PRYVC](https://pryvc.com): OAuth for contact details.

## Optional

- [Full content of every page in one file](https://geearr.com/llms-full.txt)
- [security.txt](https://geearr.com/.well-known/security.txt)
- [Sitemap](https://geearr.com/sitemap.xml)
- [georgerios.com](https://georgerios.com): George's fractional CTO practice
- [portfolio.georgerios.com](https://portfolio.georgerios.com): full product portfolio