Security for builders shipping software and AI
You built something people want to use. I’ll help you understand where it could go wrong and what to fix first.
I’m Chris, the security engineer behind ToxSec. My background includes the NSA, defense contracting and AI security at AWS. I hold a master’s in Cybersecurity Engineering and the CISSP.
I work with solo developers and small AI/SaaS teams that need experienced security help, whether you’re preparing to launch, adding an AI agent or handling your first customer security questions.
Application Security Review
A focused review of your code and security design, covering areas such as authentication, permissions, dependencies, exposed secrets and sensitive data flows.
You receive two reports:
• Source Code Security Review: prioritized findings, supporting evidence and practical fix suggestions.
• Security Design Review & Threat Model: architecture, data flows, trust boundaries and realistic threats.
Both include plain-language explanations and instructions your developers or coding agents can use to work through the findings.
AI & Agent Security
When your AI can read private data, call tools or take actions, its permissions deserve a closer look.
I review AI applications, agent workflows, RAG pipelines and tool integrations. Depending on the agreed scope, this can include adversarial testing for prompt injection, data exposure and unauthorized actions.
You receive documented risks, relevant test evidence and recommendations tied to what your system can actually do.
Cloud & Delivery Security
Review the infrastructure supporting your application: cloud permissions, exposed services, secrets, deployment configuration and CI/CD.
You receive prioritized findings and a practical hardening plan for the environment reviewed.
Fixes and Follow-up
Need help working through the results? We can scope a fix sprint around specific findings or independently verify changes your team has made.
You receive implementation evidence or a verification report showing what’s fixed, what remains and what couldn’t be verified.
How engagements work
We agree on the scope, deliverables, timeline and price before work starts. Small projects can use focused, fixed-scope engagements. Follow-up work is agreed separately.
Start with a free 30-minute consultation.
Visit the consult page or email 0xtoxsec@gmail.com.
ToxSec is an independent consulting practice. Services and opinions do not represent any current or former employer.