nandsec

Software Design and Engineering

nandsec is focused on full-stack and systems programming, which enables us to build secure software using Rust, Go, Python, TypeScript and C. The work spans software architecture and MVP planning, full-stack, back-end, front-end and mobile development, systems programming, and code modernisation.

DiscoverDesignBuildTestShip
BrowserTypeScriptAPIGoAuthsessionsDatabasePostgreSQLQueuejobsWorkerRust

GET /bookings/42 200 OK in 38 ms. The session was checked and the database queried once.

Software architecture, discovery and MVP planning

Software architecture, discovery and MVP planning covers a new product, or a system that has outgrown its first design. nandsec defines the requirements and user journeys, models the data and records each architecture decision. Each design is threat modelled before any code is written, and its security controls become part of the architecture.

Deliverables

  • Requirements and user journeys, written down and agreed
  • A domain model and database design
  • Architecture diagrams with the reason for each decision
  • A scoped MVP and a delivery plan
  • A threat model before the first commit

How it runs

We run workshops with your team and deliver written documents you own.

Domain model
Customer
iduuid
emailtext unique
nametext
Booking
iduuid
customer_id-> Customer
room_id-> Room
starts_attimestamptz
statustext
Room
iduuid
nametext
capacityint
Payment
iduuid
booking_id-> Booking
amount_centsbigint
currencychar(3)
provider_reftext
Decisions
Decision 1
PostgreSQL
Bookings and payments need transactions.
Decision 2
One service first
Split it when a part needs to scale on its own.
Decision 3
Card data never stored
The payment provider holds it.
Decision 4
Versioned API from v1
Mobile apps update slowly.

Full-stack application development

Full-stack application development covers web applications and internal tools, from the front end to the back end, database and hosting. nandsec builds authentication, authorisation and session handling into the design, and ships each feature with end-to-end tests. Applications can include AI features such as retrieval-augmented generation and tool calling.

Deliverables

  • Front end, back end and database built together
  • Authentication, authorisation and session design
  • AI and LLM features, such as retrieval and agents with tool access
  • Unit, integration and end-to-end tests in CI
  • Documentation your team can maintain

How it runs

We work in your repository under your review process or as part of your team.

Feature: cancel a booking
UIBooking.tsx
<Button onClick={cancel}>
async function cancel() {
await api.cancel(id)
toast('Cancelled') }
APIbookings.ts
app.post('/bookings/:id/cancel',
session, async (req, res) => {
const b = await getBooking(req.params.id)
if (!b) return res.sendStatus(404)
if (b.customer_id !== req.user.id)
return res.sendStatus(403)
await cancelBooking(b.id, req.user.id)
res.sendStatus(204) })
Databasecancel.sql
UPDATE booking
SET status = 'cancelled'
WHERE id = $1
AND customer_id = $2
AND status = 'confirmed'
RETURNING id;
unit: 42 passedintegration: 18 passedend-to-end: 6 passed

Back-end and API development

Back-end and API development covers APIs, services and data pipelines in Rust, Go, Python and TypeScript (Node.js), on PostgreSQL or SQLite. nandsec defines each API in an OpenAPI or GraphQL schema, and builds idempotent endpoints, versioned migrations and queues.

Deliverables

  • REST and GraphQL APIs with published schemas
  • Database design, migrations and query performance
  • Queues, data pipelines and third-party integrations
  • AI and LLM integration through provider APIs
  • Property-based and integration tests

How it runs

We agree the API contract first and build against it.

# openapi.yaml, simplified
paths:
/bookings/{id}:
get:
security: [{session: []}]
responses: {"200", "401",
"403", "404"}
/bookings:
post:
# body requires room_id, starts_at
responses: {"201", "401", "422"}
RequestCallerExpectGot
GET /bookings/42owner200200
GET /bookings/42other customer403403
GET /bookings/42no session401401
GET /bookings/999owner404404
POST /bookingsno starts_at422422

all passed Five requests match the contract, including the denied ones.

Front-end, interface and UX design

Front-end, interface and UX design covers interfaces in TypeScript with React or Svelte, built on accessible HTML and CSS. nandsec designs the interface, then builds it as a component library with a strict Content Security Policy.

Deliverables

  • User research, flows and wireframes
  • Visual design and a component library
  • Accessibility to WCAG 2.2 AA
  • WebAssembly where the browser needs native speed
  • Desktop apps with Tauri, Electron or native toolkits

How it runs

You review clickable prototypes before we write production code.

Book a room
Choose a room and a start time.
Room
Room 4, 6 people
Start time
27 Oct, 10:00
Book room
Accessibility checks
✓A label on every input
✓Text contrast 4.5:1 or more
✓Focus order follows the layout
✓Errors announced to screen readers
✓Usable at 200% zoom

Mobile app development

nandsec focuses on modern mobile app development. We cover applications for iOS and Android, native in Swift and Kotlin, or cross-platform in React Native or Flutter. nandsec stores credentials in the iOS Keychain and the Android Keystore, and builds offline sync that keeps data encrypted on the device.

Deliverables

  • Native or cross-platform, chosen for each app
  • Secure storage of tokens and keys on the device
  • Offline use and sync with your back end
  • App Store and Google Play releases

How it runs

We set up the build and release pipeline first.

10:02online
Bookings
Room 2, 09:00synced
Room 6, 13:30synced
Room 4, 10:00synced
1Sign in
Session token stored in the iOS Keychain, not in app storage.
2Connection lost
The app keeps working from its local database.
3Booking created offline
The change waits in a local queue.
4Back online
The queued change is sent and the server confirms it.
5Token refreshed
The new token replaces the old one in the iOS Keychain.

Systems programming

Systems programming covers services, libraries, command-line tools and WebAssembly modules in Rust, Go and C on Linux. nandsec writes memory-safe code where the language allows, and runs sanitisers and fuzzing in CI on the rest.

Deliverables

  • Libraries, daemons and command-line tools
  • Developer tooling and build automation
  • WebAssembly modules
  • Fuzzing and memory-safety checks in CI

How it runs

We profile before we optimise and keep the benchmarks in the repository.

Flame graph, one request453 ns
main
serve
handle_request
parse_header
route
respond
to_vec (alloc)
from_utf8
split
- let s = String::from_utf8(buf.to_vec())?;
+ let s = std::str::from_utf8(&buf)?;
Benchmark
beforeafter
parse_header392 ns189 ns
allocations10
whole request656 ns453 ns

result The parser is about 2 times faster and allocates nothing. The benchmark stays in the repository.

Code review, refactoring and modernisation

Code review, refactoring and modernisation covers a codebase that has become hard to change. nandsec adds characterisation tests first, then refactors in small steps. Where a rewrite is needed, nandsec migrates the code to another stack, such as PHP or Java to Go, Rust or TypeScript.

Deliverables

  • A code and architecture review with a ranked list of problems
  • Refactoring in small, tested steps
  • Performance profiling and optimisation
  • Legacy migration in stages

How it runs

Each change is delivered as its own reviewable step.

Traffic on the new system100%
/reportsGo service5%
/roomsGo service15%
/loginGo service10%
/bookingsGo service35%
/paymentsGo service20%
/adminGo service15%

error rate 0.1% Every route moved. The old system can be switched off.

Other services

Penetration TestingApplications, APIs, cloud, networks and internet-facing systems. Security Architecture and AdvisoryThreat models, architecture review and secure design. AI and Agent SecuritySecure setup, review and testing for AI tools, agents and AI-built software. Red Teaming and ForensicsRed and purple team engagements, compromise assessment and malware analysis. Embedded and Firmware SecurityDevices, firmware, operating systems and compiled software. Security EngineeringHardened systems, secure pipelines and secure firmware for your products. Applied ResearchSecurity research across operating systems, memory safety, malware, firmware and AI agents.

Discuss a project

Email [email protected] with what you want built or changed, who will use it and your timeframe. We reply with a scoping outline. For sensitive discussions, or if you prefer, message us on Signal or SimpleX.