Security
Web application security, code auditing (OWASP standards), data protection, and vulnerability prevention.
Claude Plugins – Skills for Claude Code
Status: Active development This repository contains a collection of Claude Code Skills that extend Claude Code with specialized knowledge and best practices for web application development. The project is available on GitHub: https://github.com/siva01c/claude-plugins Currently Available Skills Drupal Skills focused on Drupal development. They include best practices for: Module development Drupal Coding Standards Composer Drush DDEV Common development workflows Security Skills focused on web application security. They include guidance and reviews based on:
Web Security
I deal with web security where the real problems tend to be: in custom code, in outdated dependencies and in configuration. I am a cybersecurity and ethical hacking enthusiast, and I bring that mindset to every site I work on. Fixing vulnerabilities Got a vulnerability notice, or did a scanner or an auditor find one? I verify whether it can be exploited on your site, fix it in the code or with an update, and add a check so the same bug does not come back. That applies to Drupal and Hugo as well as to sites I did not build.
Website Maintenance
A website is not finished on launch day. Security updates come out, modules age and PHP versions reach end of life. I take over looking after your site – whether I built it or someone else did – and keep it up to date, backed up and safe to change. What follows is what I actually do for clients, not a catalogue of promises. What maintenance covers Security patches – I follow Drupal’s security advisories and roll out core and module patches as a priority once they are released. Daily backups with an off-site copy – the database and files are backed up every day and the copy is kept somewhere other than the site. The backup comes with a written restore procedure, so it is clear how to bring the site back instead of working it out when it is needed. Tests and CI before release – every update and change goes through automated checks and tests in CI first, and only then to production. Secure operation – passwords and keys kept out of the repository, separated access, and a server set up to expose no more than it has to. Ongoing updates and upgrades – modules, libraries and PHP, so technical debt does not pile up, and upgrades between major Drupal versions including changes to custom code. How we work together Initial review – I go through the site, the code and the hosting and write down what needs putting in order. Putting things in order – updates, backups, CI and fixes for what the review found. Regular maintenance – patches, updates and small improvements as needed. We size the scope to the site. I track my time and invoice the hours worked, so you pay exactly for what needed doing.
Vibe-Coded App Review
You built your app with Claude Code, Cursor, Lovable, Bolt or another AI agent, and it works. Before you let it near your customers and their data, though, it is worth knowing what is really inside. AI writes fast and convincingly, but it can just as quickly skip a permission check or put a key straight into the code. I use vibe coding every day and teach it, so I know where agents go wrong most often.
Hacked Website Repair
Is your site redirecting visitors to strange pages, showing a warning in Google, blocked by your host for spam, or are there files on the server nobody put there? I fix hacked websites whether they run on Drupal, WordPress or anything else – and whether I built them or someone else did. How I go about it Isolation – I stop the damage: take the site offline or into maintenance mode, change passwords and access, and back up the current state as evidence for the analysis. Analysis – I find out how the attacker got in and what they changed: a vulnerable module or plugin, a leaked password, a backdoor in the files or the database. Cleanup – I remove the malicious code, rogue accounts and files. Where it is safer, I rebuild the site from a clean backup or from source and bring back only verified data. Patching – I close the hole the attacker used and update the core, modules or plugins and dependencies. Prevention – I set up backups with an off-site copy, separated permissions and checks so the same attack does not happen again. I also help with the request to remove the warning from Google. At the end you get a short write-up of what happened, what I did and what I recommend next.