nandsec

Security Engineering

nandsec is focused on building secure computing environments, from hardened Linux systems and workstations to Secure Boot and secure CI/CD pipelines. This includes taking an early product to production, firmware and driver development, security tooling and the remediation of findings from testing. Work is delivered as code and documentation in your repository, under your licence.

#214 Add payment webhook handler
7be2d13 Read webhook secret from the environment
Unit testspassed
Type checkpassed
Static analysis (Semgrep)passed
Dependency auditpassed
Secret scanpassed
Authorisation testspassed
Security owner reviewpassed
Ready to merge
The secret is rotated, moved to the environment and removed from the branch history. All checks pass.

Prototype to production

Prototype to production covers an early product, often built quickly or with AI coding tools, that now has real users. nandsec rotates secrets out of the code, fixes access rules and session handling, and pins dependencies. It also sets up tested backups and structured logging.

Deliverables

  • Secrets moved out of code and rotated
  • Authentication, sessions and access rules fixed
  • Logging, backups and error handling
  • Pinned dependencies and automated updates

How it runs

We start with a short review and make agreed changes as reviewed pull requests.

SecretsKept in a managed vault and rotated
Sign-inMFA for staff and offered to customers, rate-limited login
Data accessRow-level security on every table
InputValidated on the server
ErrorsGeneric errors, detail in logs
LoggingAudit log for sign-in, payments, admin
BackupsDaily, restore tested monthly
DependenciesPinned, updated weekly
Production ready

Secure CI/CD pipeline design and review

Secure CI/CD pipeline design and review protects the pipeline that builds and ships your software against supply chain attacks. Examples are a compromised developer account or a malicious pull request. nandsec scopes workflow permissions and secrets, pins third-party actions and signs each artefact. Production then accepts only what your pipeline built.

Scope

  • Repository permissions and branch protection
  • Workflows that run code from forks or untrusted input
  • Secrets available to build jobs
  • Artefact signing and what production accepts

How it runs

We change your pipeline through reviewed pull requests or design a new one with you.

Fork PR
Changes a test script
compromised
CI job
Runs the changed script (pull_request_target)
compromised
Secrets
Deploy token in env
compromised
Build
Artefact produced
compromised
Registry
Image pushed
compromised
Production
Image deployed
compromised

no controls An external pull request reaches production. The modified test script runs in CI with access to the deploy token.

Hardened Linux systems and developer workstations

Hardened Linux systems and developer workstations covers images for appliances, servers and workstations that boot only signed code. nandsec builds each image with Secure Boot under your own keys, disk encryption sealed to TPM 2.0, kernel lockdown and an access control policy.

Deliverables

  • Signed images and Secure Boot under your own keys
  • TPM 2.0 measured boot bound to disk encryption
  • Kernel configuration, lockdown and access control policy
  • Reproducible builds and an update process

How it runs

We deliver the build scripts with each image for your team to rebuild and update.

Secure Boot
Passes
Every stage verifies the next one before running it.
Measured boot (TPM 2.0, PCRs 0, 4, 7, 9)
Disk unlocks
PCR values match the policy the disk key was sealed against. PCR 7 records the Secure Boot state and the enrolled keys.

Firmware and driver development

Firmware and driver development covers bootloaders, device drivers and update mechanisms, built on a verified chain of trust. nandsec writes drivers in C or Rust and delivers signed A/B updates with rollback protection, tested on your boards from the first build.

Deliverables

  • Secure Boot chains and key provisioning
  • A/B updates with signature checks and rollback
  • Drivers in C or Rust
  • Fuzzing harnesses for parsers and interfaces

How it runs

We build to your hardware and coding standards and test on your boards.

1
Download
ok
2
Verify signature and version
ok
3
Write slot B
ok
4
Reboot into B (bootloader verifies)
ok
5
Health check
ok
6
Commit
ok
Slot Astandby
v2.3.2
Slot Brunning, committed
v2.4.0

good image The image is verified and checked against the minimum version before writing, trial-booted, and committed after a successful health check.

Security tooling and automation

Security tooling and automation makes security checks routine in your pipeline, including secret scanning, dependency checks and custom static analysis rules. nandsec writes static analysis rules for your codebase and the scanner you already use. It also builds coverage-guided fuzzing and hardware test rigs that run on every change.

Deliverables

  • CI checks for secrets, dependencies and code patterns
  • Static analysis rules for your codebase
  • Coverage-guided fuzzing that runs continuously
  • Test rigs for devices and protocols

How it runs

Each tool is built to run in your pipeline with a low false positive rate.

Executions0
Blocks covered1 / 336 (0%)
Corpus inputs6
Crashes0
$ ./fuzz_parse_header corpus/ -max_len=4096

Remediation support

The objective of remediation support is to close the findings of a penetration test, whether nandsec ran the test or another provider did. nandsec fixes each finding as a pull request, including shared fixes for bugs that repeat across a codebase, and retests once the fixes are merged.

Deliverables

  • Fixes for findings, written as pull requests
  • Shared fixes for bugs that repeat across a codebase
  • Configuration changes in cloud and Linux systems
  • Retesting once fixes are merged

How it runs

We work from the report and your issue tracker and follow your code review process.

CriticalHighMediumLow

week 8 ยท 4 open Retest 2: 24 of 28 closed. Letter of assessment issued.

Other services

Penetration TestingApplications, APIs, cloud, networks and internet-facing systems. Security Architecture and AdvisoryThreat models, architecture review and secure design. AI and Agent SecuritySecure setup, review and testing for AI tools, agents and AI-built software. Red Teaming and ForensicsRed and purple team engagements, compromise assessment and malware analysis. Embedded and Firmware SecurityDevices, firmware, operating systems and compiled software. Software Design and EngineeringArchitecture, full-stack, mobile and systems development. Applied ResearchSecurity research across operating systems, memory safety, malware, firmware and AI agents.

Discuss a project

Email [email protected] with what you need built or fixed and the stack you use. We reply with a scoping outline and an estimate. For sensitive discussions, or if you prefer, message us on Signal or SimpleX.