The fractional CTO who ships.

A Wollongong community-services and NDIS provider reached out for a one-off security review on their meal-delivery platform. I found seven critical issues on the first pass. One would have let an attacker take over any user's account. They fixed it within three days.

The engagement didn't end there. The review became a full website rebuild, then a retainer. I moved their operations platform and marketing site from files edited directly in a shared drive onto a proper system where every change is tracked and reversible. Passwords and secrets moved into a secure vault.

A Wollongong community-services and NDIS provider reached out for a one-off Laravel security review on their meal-delivery operations platform. I found seven critical issues on the first pass. One was a launch-blocking account-takeover vulnerability with two distinct attack vectors. They remediated it within three days of early notice.

The engagement didn't end there. The review became a full website rebuild, then an infrastructure retainer. I moved the operations platform and marketing site off files edited directly in OneDrive onto a modern deploy process where every change is tracked and reversible. Secrets moved into 1Password.

An Australian startup was building a personal data vault where only the user holds the keys. The company itself can't see customer data, even if forced to. That promise is only as strong as the security system underneath it.

I built that security system from scratch. When it was done the team needed a mobile developer next. That was in my wheelhouse, so I shifted to building the Flutter mobile app on top of it. I released the supporting code as open source, MIT-licensed, under the byterix-labs GitHub organisation.

An Australian-founded data-sovereignty startup was building a zero-knowledge personal data vault. Users hold the only keys. The company can't decrypt customer data even if compelled to. That promise is only as strong as the crypto infrastructure underneath it.

I built the greenfield cryptographic key management service from first principles in Zig, a language with almost no ecosystem support for the protocols required. It implemented enough of the KMIP 2.0 spec to meet our needs, with libsodium bindings and a streaming data library with memory/filesystem fallback. I released the supporting libraries MIT-licensed back to the community under the byterix-labs GitHub organisation. When the KMS was done the team needed a mobile developer next. That was in my wheelhouse, so I shifted to building the greenfield Flutter mobile client on top of it.

The first engagement was small and specific. Anthony, a non-technical founder building a mobile game at Studio Gema, needed to hire a technical co-founder and knew enough to know he wasn't technical enough to evaluate candidates on his own. Tightly scoped: interview briefs, sit on the technical interviews, write up a recommendation. Fixed fee. Two candidates. Done in a week.

Eighteen months later, Anthony was back. New company: NoteJam, a B2B SaaS notes app for sales reps, built from scratch with a contract development team. Exactly the same need: a senior engineer on the decisions he couldn't afford to get wrong. The second engagement was bigger and broader. A few months of advisory across the MVP build (how the app connects to existing sales tools, hosting, technology choices, strategy deck Q&A), followed by another co-founder interview pass. This time with four candidates instead of two.

The first engagement was small and specific. Anthony, a non-technical founder building a mobile game at Studio Gema, needed to hire a technical co-founder and knew enough to know he wasn't technical enough to evaluate candidates at depth on his own. Tightly scoped: interview briefs, sit on the technical interviews, write up a recommendation. Fixed fee. Two candidates. Done in a week.

Eighteen months later, Anthony was back. New company: NoteJam, a B2B SaaS notes app for sales reps, built from scratch with a contract development team. Exactly the same need: a senior engineer on the decisions he couldn't afford to get wrong. The second engagement was bigger and broader. A few months of fractional-CTO advisory across the MVP build (CRM integration architecture, hosting issues, tech stack review, strategy deck Q&A), followed by another CTO co-founder interview pass. This time with four candidates instead of two.

An Australian renewable-energy platform had three problems. Their mobile app had become a bottleneck, blocking features the product team wanted to ship. Infrastructure changes were being made by hand and going undocumented. And the data pipelines pulling readings from hardware in the field were unreliable enough to be untrustworthy.

I worked through all three. I got the mobile app back to a state where the team could ship features again. I converted the manual infrastructure changes into a system that could be reviewed, reproduced, and rolled back. I rewrote the data pipelines for reliability, and the readings became something the team could trust.

An Australian renewable-energy and distributed-energy-resources platform had three problems. On the mobile side, a legacy Ionic Angular app had become a bottleneck, blocking features the product team wanted to ship. On the infrastructure side, cloud changes were being made manually and going undocumented. On the data side, Python ETL pipelines ingesting telemetry from field hardware were unreliable enough to be untrustworthy for downstream decisions.

I worked through all three. I got the mobile app back to a state where the team could ship features again. I converted the manual cloud changes into version-controlled Terraform deploys that could be reviewed, reproduced, and rolled back. I rewrote the ETL pipelines for reliability, and the telemetry became something the team could trust.