# Application Security — geearr

> Application security (AppSec) is the practice of finding and preventing vulnerabilities in the software itself — its code, architecture, identity flows and build pipeline. geearr does manual secure code review, threat modeling and OAuth/OIDC review, then leaves guardrails in your CI so the bugs do not come back.

**Application security from someone who ships code.**

George has built OAuth 2.0 / OIDC servers, accountless identity systems and tamper-evident audit logs — so he knows where these systems break. AppSec engagements focus on the code and architecture itself: find the flaw before it ships, and leave your team with guardrails that keep it from coming back.

## What gets tested

### Code & architecture

- Manual secure code review: .NET/C#, TypeScript/Node, Python, Go
- Threat modeling with STRIDE & data-flow diagrams
- Multi-tenant isolation & authorization design
- Cryptography usage & key management
- Input handling, deserialization & SSRF sinks

### Identity & access

- OAuth 2.0 / OIDC flows, PKCE & token handling
- Passkeys, WebAuthn & MFA implementation
- Session management & refresh-token rotation
- RBAC / ABAC policy review
- SSO & SCIM integration hardening

### Pipeline & supply chain

- SAST, DAST, SCA & secrets scanning in CI
- GitHub Actions & pipeline permission hardening
- Dependency & package provenance: SBOM, SLSA
- Container & infrastructure-as-code review
- Secure SDLC & security-champion playbook

## What you get

1. Threat model and data-flow diagrams for critical systems
2. Code-level findings with suggested patches or pull requests
3. CI/CD guardrails configured in your actual pipeline
4. Secure coding checklist tailored to your stack
5. Optional ongoing review of high-risk changes

## Standards

OWASP Top 10 · OWASP ASVS · OWASP SAMM · NIST SSDF (SP 800-218) · SLSA · CWE Top 25 · RFC 9700 (OAuth 2.0 Security BCP)

## FAQ

### What does a secure code review cover?

A secure code review is a manual, line-level examination of the code paths that matter most — authentication, authorization, data access, input handling, cryptography and integrations — supported by static analysis. It finds logic flaws and design mistakes that automated tools cannot, and each finding comes with a concrete fix.

### Do you fix the vulnerabilities you find?

Yes. Unlike report-only firms, George Rios is also a working engineer and fractional CTO, so engagements can include writing the patches, opening pull requests, and pairing with your developers until each issue is closed and verified.

### Can you review our OAuth or OIDC implementation?

Yes. Identity is a specialty — George built AuthnzNet, an OAuth 2.0 + OIDC server with PKCE and RS256 signing, and Identizen, an accountless OIDC login system. Reviews cover flow selection, PKCE, redirect URI validation, token storage, signing keys, refresh rotation and logout.

## Related

- Guide: [OAuth 2.0 & OpenID Connect security review checklist](https://geearr.com/guides/oauth-oidc-security-review)
- Glossary: [Threat modeling](https://geearr.com/glossary#threat-modeling)
- Glossary: [STRIDE](https://geearr.com/glossary#stride)
- Glossary: [SAST](https://geearr.com/glossary#sast)
- Glossary: [DAST](https://geearr.com/glossary#dast)
- Glossary: [SCA](https://geearr.com/glossary#sca)
- Glossary: [SBOM](https://geearr.com/glossary#sbom)
- Glossary: [OAuth 2.0](https://geearr.com/glossary#oauth)
- Glossary: [OpenID Connect (OIDC)](https://geearr.com/glossary#oidc)
- Glossary: [PKCE](https://geearr.com/glossary#pkce)
- Glossary: [JWT](https://geearr.com/glossary#jwt)

## Contact

- Email: george@georgerios.com
- Book a free 30-minute scoping call: https://cal.com/georgerios/30min
- LinkedIn: https://linkedin.georgerios.com
- X: https://x.com/riosgeorge

---
Canonical: https://geearr.com/services/application-security · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt