// secure software · government of canada
Secure .NET development and code review for Canadian federal systems. Every finding mapped to CWE, OWASP and ITSG-33, with the fix written and re-tested.
Insecure deserialization in document import
Two things, done properly.
C# and .NET applications for federal IT projects, with security designed in at the architecture stage: threat modelling before code, secure-by-default patterns during, hardening verified before delivery.
Existing .NET codebases read line by line, findings ranked by exploitability and business impact rather than raw severity. Fixed scope, typically 2 to 6 weeks.
stack C# · .NET 8+ · ASP.NET Core · Entity Framework · Azure · REST · gRPC · OAuth 2.0 / OIDC · mTLS
We build what we review. Our own product, in production.
// case study · in-house product
A reading app for books, comics and audiobooks from open libraries. One C# codebase ships to Windows and iPhone, with accounts, a wallet and a store behind it. We designed it the way we would want a federal system designed: the server trusts nothing it did not verify.
Scrolling on a 2019 iPhone, up from 20
Profiled on device, traced to a per-frame save-layer, baked it out of the render path.
Streaks, rankings and rewards recomputed server-side
Only verified reading sessions count. A modified client can lie; it cannot score.
A wallet that cannot double-spend
Every spend is idempotent and asked of the server first; earning is capped per day.
Anonymous accounts that cannot be farmed
Device identity held in the iOS Keychain; merges rate-limited; empty guests swept.
stack C# · .NET 8 · Avalonia · SkiaSharp · Native AOT on iOS · Cloudflare Workers · D1
Controls applied at every trust boundary, not just the perimeter.
Reference architecture for a secure .NET API. ITSG-33 controls shown on each link.
ITSG-33CCCS security control familiesOWASP ASVS L2Verification baselineCWE Top 25Every finding tracked to its classNIST SSDFSecure development practiceGC Cloud GuardrailsGovernment of Canada cloudCCCS guidanceCross-sector cyber securityOWASP Top 10Coding and review categoriesISO/IEC 27001Where the client works to itPick the line that fits you. One email starts it.
Bid managers and capture leads adding a secure .NET subcontractor to a TBIPS, ProServices or SBIPS bid.
You get CVs, the capability statement and a teaming agreement template.
Email TEAMINGProgram and IT leads who need a code review, a security gate before release, or a secure build.
You get a scoping call and a fixed-scope proposal, through a prime or a direct vehicle.
Email CAPABILITYCanadian citizens or permanent residents, cleared or clearable, with five or more years of production .NET.
Send your CV and clearance status.
Email BENCHReady to sit on your bid.
| Vehicle | Role |
|---|---|
| TBIPS Stream 5 Application Development | Subcontract via prime |
| TBIPS Stream 6 Cyber Protection | Subcontract via prime |
| ProServices | Task authorization via prime |
| SBIPS | Task authorization via prime |
| Standing offers | Direct, as eligibility expands |
Bid managers and capture leads: we reply with CVs, the capability statement and a teaming agreement template. Federal government, defence and public safety, and critical infrastructure.
Small on purpose.
Reply within one business day.
Eastern Time. No NDA needed for a first contact; we sign one before sharing CVs or scoping documents.
Start your subject with TEAMING, CAPABILITY, BENCH or GENERAL so it reaches the right inbox fast.