guest@geearr:~/services$ man geearr-appsec
NAME
geearr-appsec — application security by George Rios
Application Security: Application security from someone who ships code.
SYNOPSIS
geearr appsec [--code] [--threat-model] [--identity] [--pipeline] <repo>DESCRIPTION
George has built OAuth 2.0 / OIDC servers, accountless identity systems and tamper-evident audit logs — so he knows where these systems break. AppSec engagements focus on the code and architecture itself: find the flaw before it ships, and leave your team with guardrails that keep it from coming back.
OPTIONS — WHAT GETS TESTED
--code · Code & architecture
- Manual secure code review: .NET/C#, TypeScript/Node, Python, Go
- Threat modeling with STRIDE & data-flow diagrams
- Multi-tenant isolation & authorization design
- Cryptography usage & key management
- Input handling, deserialization & SSRF sinks
--identity · Identity & access
- OAuth 2.0 / OIDC flows, PKCE & token handling
- Passkeys, WebAuthn & MFA implementation
- Session management & refresh-token rotation
- RBAC / ABAC policy review
- SSO & SCIM integration hardening
--pipeline · Pipeline & supply chain
- SAST, DAST, SCA & secrets scanning in CI
- GitHub Actions & pipeline permission hardening
- Dependency & package provenance: SBOM, SLSA
- Container & infrastructure-as-code review
- Secure SDLC & security-champion playbook
OUTPUT — WHAT YOU GET
- 01Threat model and data-flow diagrams for critical systems
- 02Code-level findings with suggested patches or pull requests
- 03CI/CD guardrails configured in your actual pipeline
- 04Secure coding checklist tailored to your stack
- 05Optional ongoing review of high-risk changes
EXAMPLES
$ geearr appsec --code --threat-model ./billing-service STRIDE model: 6 trust boundaries · 11 threats ranked PR #482: enforce tenant scope in InvoiceRepository
$ geearr appsec --identity --flow authorization_code+pkce redirect_uri: prefix match → exact match required refresh tokens: rotation on · reuse detection on
# illustrative output
CONFORMING TO
- OWASP Top 10
- OWASP ASVS
- OWASP SAMM
- NIST SSDF (SP 800-218)
- SLSA
- CWE Top 25
- RFC 9700 (OAuth 2.0 Security BCP)
FAQ
[+][-]What does a secure code review cover?
A secure code review is a manual, line-level examination of the code paths that matter most — authentication, authorization, data access, input handling, cryptography and integrations — supported by static analysis. It finds logic flaws and design mistakes that automated tools cannot, and each finding comes with a concrete fix.
[+][-]Do you fix the vulnerabilities you find?
Yes. Unlike report-only firms, George Rios is also a working engineer and fractional CTO, so engagements can include writing the patches, opening pull requests, and pairing with your developers until each issue is closed and verified.
[+][-]Can you review our OAuth or OIDC implementation?
Yes. Identity is a specialty — George built AuthnzNet, an OAuth 2.0 + OIDC server with PKCE and RS256 signing, and Identizen, an accountless OIDC login system. Reviews cover flow selection, PKCE, redirect URI validation, token storage, signing keys, refresh rotation and logout.
SEE ALSO
guides: OAuth 2.0 & OpenID Connect security review checklist
glossary: threat-modeling(7), stride(7), sast(7), dast(7), sca(7), sbom(7), oauth(7), oidc(7), pkce(7), jwt(7)
shipped: identizen(8) — Accountless identity., authnznet(8) — OAuth 2.0 + OIDC server in three commands., pryvc(8) — OAuth for contact details.
services: geearr-pentest(1), geearr-email(1), geearr-cloud(1), geearr-ai(1)
EXIT STATUS
0 when every finding is closed and retested. Anything else means we keep going.
BUGS
None known. That’s what retests are for. Found one in this site? security.txt