Skip to content
Bulwark Black Bulwark Black LLC
Latest
Open Source Supply Chain Compromise Needs Build-Pipeline Defense, Not Just Dependency ScanningCosmosEscape Shows Why Managed Cloud Databases Still Need Customer-Side DefenseAutonomous AI Agent Espionage Shows Why Post-Compromise Speed MattersSharePoint KEV Listing Turns Collaboration Servers Into Incident-Response PrioritiesJscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay InfrastructureFortiBleed Shows Firewall Credentials Are Ransomware Fuel

What We Build

Built it, shipped it, still run it.

We are a small veteran-owned studio, so the honest way to show what we can build is to show what we already built and still keep running. Two of these have paying users. One is on the App Store. Two are open source and you can read every line. The servers underneath them are ours, and we administer them.

Stacks are listed because they are the part you can check. If you want a walkthrough of any of it, including the parts that went badly, ask and you will get one.

Start a Project → Infrastructure & Personal Work →

Products

Software with users on it.

Five products. Every one of them is running right now, and none of them is a prototype we dressed up for a portfolio.

  • SaaS · Service businesses

    Live

    Contractor Codex

    Multi-tenant billing and client portal for service businesses. Quotes come out of a 240 row starter library covering 24 industries, go out as a tokenized link the client can sign, and raise a deposit invoice the moment they accept. Contracts get a clause library and in-app countersign. Invoices handle recurring billing, partial refunds, and a four level dunning ladder. Clients log in to approve work, pay, and e-sign.

    Next.js 16, Postgres and Prisma, Clerk, Stripe Connect, Resend, S3

    Every org gets its own Stripe Connect account, Resend sending domain, industry seed data, and branding. Multi-tenant is cheap to say and expensive to actually mean.

    contractorcodex.com →

  • SaaS · Federal contracting

    Live

    SAMscout AI

    Turns a SAM.gov opportunity into a reviewable, Shipley-grade proposal draft in minutes. Built for small businesses that want to bid federal work without keeping a proposal team on payroll. It is the largest codebase we run.

    JavaScript, hosted app at app.samscout.ai with a separate static marketing site

    samscout.ai → Open the app →

  • iOS · Veterans

    Live

    VA Disability Calc & Track

    An iPhone and iPad app for veterans working a VA claim. BVA-accurate combined rating math, over 900 diagnostic codes, back pay estimates, and an encrypted document vault. It runs fully offline, so nothing about a claim leaves the device.

    SwiftUI, Core Data, iOS 18+

    The claims process is hard enough. Offline was a requirement, not a feature, because the data involved is medical and nobody should have to trust us with it.

    Download on the App Store →

  • Field tool · Open source

    Open Source

    WiFi Site Survey

    A local web tool for professional Wi-Fi and cellular site surveys on a Mac. Walk a property with your phone streaming GPS, tap readings as you go, and watch a coverage heatmap build with pass or fail contour lines. Aim a cellular gateway by RSRP and SINR, score the site from 0 to 100, attach photos, and print a client-ready PDF. No cloud, no login, and nothing to install beyond the Python that already ships with macOS.

    Python and JavaScript, served from 127.0.0.1 on the technician's own machine

    Survey tools that phone home are a hard sell standing in someone's building. Keeping every reading on the local machine removed the objection entirely.

    GitHub →

  • iOS · Open source

    Open Source

    Free TwiSMS

    A native iPhone app for reading and sending texts, MMS, and files through a Twilio number, backed by a small self-hosted connector. Written as the client for our own phone system and then released, because the paid options all wanted a subscription to talk to a number you already pay for.

    SwiftUI, Twilio, self-hosted connector

    GitHub →

Sites

And the sites we run ourselves.

Designed, built, deployed, and maintained in-house. No page builders, no agency retainer, no third-party platform holding the content.

  • This site

    Live

    bulwarkblack.com

    A cyber threat intelligence magazine with roughly 390 articles migrated off WordPress with every original URL preserved. New reporting is published by an automated pipeline that extracts indicators, writes IOC and YARA downloads, and rebuilds the static site on its own.

    Astro, Tailwind, static build on a DigitalOcean droplet behind Nginx

  • Product marketing site

    Live

    samscout.ai

    The public landing site for SAMscout, kept deliberately separate from the app. Static output with no client framework, so the only JavaScript that ships is view transitions and two small inline scripts.

    Astro, static output

  • Services site

    Live

    ruraltechandsupport.com

    Static-first site with a few server-rendered API routes for forms, served by Nginx with a small Node service under systemd. Same droplet, separate vhost, separate build.

    Astro 5, TypeScript, Tailwind, Node under systemd

  • Internal tooling

    Shipped

    Client deliverables host

    A static site for handing clients their reports, audits, migration plans, and documentation without emailing attachments around. Public landing page, private per-client pages.

    HTML and CSS, deployed to Netlify

Need Something Like This

We build for small businesses and federal buyers.

Veteran-owned, SDVOSB, and SAM-registered. If you have a process that lives in spreadsheets and email, it is usually the thing worth building first.

Contact Us → Capability Statement →