Skip to content
Latest
Cloudflare workerd Bugs Show Why Agent Sandboxes Need Real Defense-in-DepthLangflow RCE Shows Why AI Workflow Tools Need Cloud-Grade IsolationBINDCLOAK Shows Why C2 Detection Needs Message-Level VisibilityPasskey Attacks Show Why Passwordless Still Needs Endpoint DefenseDPRK npm Compromises Show Why Dependency Trust Is Now Identity RiskN-able N-central Exploitation Shows Why MSP Tools Are Control-Plane RiskHOLLOWGRAPH Shows Why Microsoft 365 Is Now Part of the C2 BattlefieldFuyao Android TV Botnet Shows Why Cheap Streaming Sticks Are Business Network RiskSonicWall SMA Exploit Chain Shows Why VPN Appliances Need Incident Response, Not Just PatchingAdform Script Compromise Shows Why Third-Party Tags Need Supply-Chain ControlsCaptiveCrunch Shows Why Travel Wi-Fi Is Now an Identity Attack SurfaceXCSSET v40 Shows Why Developer Macs Are Supply-Chain Infrastructure84 4G/5G Core Flaws Show Why Telecom Trust Zones Need Zero TrustAstaroth WhatsApp Web Spambot Shows Browser Sessions Are Distribution Infrastructure

What We Build

Built it, shipped it, still run it.

We are a small veteran-owned studio, so the honest way to show what we can build is to show what we already built and still keep running. Two of these have paying users. One is on the App Store. Two are open source and you can read every line. The servers underneath them are ours, and we administer them.

Stacks are listed because they are the part you can check. If you want a walkthrough of any of it, including the parts that went badly, ask and you will get one.

Products

Software with users on it.

Five products. Every one of them is running right now, and none of them is a prototype we dressed up for a portfolio.

  • SaaS · Service businesses

    Live

    Contractor Codex

    Multi-tenant billing and client portal for service businesses. Quotes come out of a 240 row starter library covering 24 industries, go out as a tokenized link the client can sign, and raise a deposit invoice the moment they accept. Contracts get a clause library and in-app countersign. Invoices handle recurring billing, partial refunds, and a four level dunning ladder. Clients log in to approve work, pay, and e-sign.

    Next.js 16, Postgres and Prisma, Clerk, Stripe Connect, Resend, S3

    Every org gets its own Stripe Connect account, Resend sending domain, industry seed data, and branding. Multi-tenant is cheap to say and expensive to actually mean.

  • SaaS · Federal contracting

    Live

    SAMscout AI

    Turns a SAM.gov opportunity into a reviewable, Shipley-grade proposal draft in minutes. Built for small businesses that want to bid federal work without keeping a proposal team on payroll. It is the largest codebase we run.

    JavaScript, hosted app at app.samscout.ai with a separate static marketing site

  • iOS · Veterans

    Live

    VA Disability Calc & Track

    An iPhone and iPad app for veterans working a VA claim. BVA-accurate combined rating math, over 900 diagnostic codes, back pay estimates, and an encrypted document vault. It runs fully offline, so nothing about a claim leaves the device.

    SwiftUI, Core Data, iOS 18+

    The claims process is hard enough. Offline was a requirement, not a feature, because the data involved is medical and nobody should have to trust us with it.

  • Field tool · Open source

    Open Source

    WiFi Site Survey

    A local web tool for professional Wi-Fi and cellular site surveys on a Mac. Walk a property with your phone streaming GPS, tap readings as you go, and watch a coverage heatmap build with pass or fail contour lines. Aim a cellular gateway by RSRP and SINR, score the site from 0 to 100, attach photos, and print a client-ready PDF. No cloud, no login, and nothing to install beyond the Python that already ships with macOS.

    Python and JavaScript, served from 127.0.0.1 on the technician's own machine

    Survey tools that phone home are a hard sell standing in someone's building. Keeping every reading on the local machine removed the objection entirely.

  • iOS · Open source

    Open Source

    Free TwiSMS

    A native iPhone app for reading and sending texts, MMS, and files through a Twilio number, backed by a small self-hosted connector. Written as the client for our own phone system and then released, because the paid options all wanted a subscription to talk to a number you already pay for.

    SwiftUI, Twilio, self-hosted connector

Sites

And the sites we run ourselves.

Designed, built, deployed, and maintained in-house. No page builders, no agency retainer, no third-party platform holding the content.

  • This site

    Live

    bulwarkblack.com

    A cyber threat intelligence magazine with roughly 390 articles migrated off WordPress with every original URL preserved. New reporting is published by an automated pipeline that extracts indicators, writes IOC and YARA downloads, and rebuilds the static site on its own.

    Astro, Tailwind, static build on a DigitalOcean droplet behind Nginx

  • Product marketing site

    Live

    samscout.ai

    The public landing site for SAMscout, kept deliberately separate from the app. Static output with no client framework, so the only JavaScript that ships is view transitions and two small inline scripts.

    Astro, static output

  • Services site

    Live

    ruraltechandsupport.com

    Static-first site with a few server-rendered API routes for forms, served by Nginx with a small Node service under systemd. Same droplet, separate vhost, separate build.

    Astro 5, TypeScript, Tailwind, Node under systemd

  • Internal tooling

    Shipped

    Client deliverables host

    A static site for handing clients their reports, audits, migration plans, and documentation without emailing attachments around. Public landing page, private per-client pages.

    HTML and CSS, deployed to Netlify

Need Something Like This

We build for small businesses and federal buyers.

Veteran-owned, SDVOSB, and SAM-registered. If you have a process that lives in spreadsheets and email, it is usually the thing worth building first.

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.