Application engineering
An internal operations portal.
Built a full-stack portal for an AI claims company, connecting the application with its database and identity provider.
Next.js · TypeScript · MongoDB · Auth0 · Vercel
Matthew Toro Independent engineer
Build the software.
Secure the system.
Full-stack development and cybersecurity, from the first working version to the systems it depends on. Bring me the project you want to build or the system that needs attention.
Custom projects. Fixed-scope services when the brief fits.
Selected experience 実務経験
The work behind
the services.
Application development and security work from my DevSecOps role, alongside independent technical projects.
View the portfolioSecurity engineering
Testing that leads to a fix.
Completed a penetration test of company systems and applications, documented the findings, and provided remediation guidance. Hardened infrastructure supporting the platform.
Compliance engineering
Controls in the running system.
Led SOC 2 compliance work and implemented Azure controls for SOC 2, HIPAA and PCI requirements, using Vanta to support the work.
Custom projects ご相談
What are you
working on?
You do not need a finished specification to start a conversation. Tell me what you have and what you need next.
Talk through your projectSoftware & applications
Internal tools, web applications and integrations. Frontend, backend and database work with authentication considered from the start.
Penetration testing & review
Source and API review, or a separately authorized penetration test. Findings with remediation guidance, not a promise that every vulnerability has been found.
Dynamic testing requires written owner authorization and an agreed testing boundary. Read the authorization requirements.
Infrastructure & compliance
Azure and AWS hardening, virtualization and network security. Engineering support for SOC 2, HIPAA and PCI programs.
Automation & community tools
Connect existing systems, repair unreliable workflows, or build a focused bot for the platform your team uses.
Fixed-scope catalog サービス一覧
A smaller brief?
Start here.
Five defined engagements can be booked directly. The published scope, exclusions, timing, price, and refund terms form the engagement record.
Read the service termsCatalog engagements require a U.S. billing address. Prices are in USD. Custom work and dynamic testing still start by email.
API Security Review
$2,500
3 business days after kickoff, access, and authorization
Source and configuration review. Dynamic testing requires a separately signed authorization.
View scope and exclusions
- Included
-
- One repository and one API surface
- Source, configuration, dependency, authentication, and authorization review
- Evidence-backed findings with severity and remediation, highest-value in-scope patches, one verification pass, and one in-scope revision
- Review boundary
-
Source and configuration analysis by default. Dynamic testing requires a separately signed scope with exact targets, dates, prohibited techniques, an emergency contact, revocation handling, written owner authorization, and hosting-provider policy confirmation. Denial of service, credential attacks, persistence, social engineering, and third-party targets are excluded. No review promises complete vulnerability discovery, compliance, or security.
Dynamic penetration testing is available as a signed add-on scope. Ask when you send your review request.
- Price
- $2,500
- Turnaround
- 3 business days after kickoff, access, and authorization
Stripe-hosted checkout books the published source and configuration review. Dynamic testing requires a separate signed scope.
Book this service Ask about the scopeAS-2500 Equipment reference: Toshiba T3100 · 1986 · Intel 80286 · 640KB RAM
Full-Stack Application Development
$3,500
7 business days after kickoff and required access
One agreed application. Hosting, native mobile apps and integrations beyond two systems are excluded.
View scope and exclusions
- Included
-
- One web application: frontend, backend, and database
- Authentication and one deployment target
- A handoff guide, one verification pass, and one in-scope revision
- Not included
Ongoing hosting or operation, native mobile applications, and third-party integrations beyond two systems. Built on the same ground as production internal tooling delivered before: Next.js and TypeScript, a hosted database, an identity provider, and one managed deployment target.
- Price
- $3,500
- Turnaround
- 7 business days after kickoff and required access
Stripe-hosted checkout books the application described above. Email first if your features or integrations do not fit that boundary.
Book this service Ask about the scopeFS-3500 Equipment reference: Sony NEWS · 1987 · dual MC68020 · 2MB RAM
Secure Automation Sprint
$2,500
5 business days after kickoff and required access
One workflow, up to two external systems. Ongoing hosting and support are excluded.
View scope and exclusions
- Included
-
- One existing business workflow across at most two external systems
- Up to eight automated steps with input validation and failure handling
- One runnable verification, a handoff guide, and one in-scope revision
- Not included
Data migration, hardware, regulated or high-impact automated decisions, new product development, ongoing hosting, or support.
- Price
- $2,500
- Turnaround
- 5 business days after kickoff and required access
Stripe-hosted checkout books one workflow within the limits above. Email first if the workflow makes regulated or high-impact decisions.
Book this service Ask about the scopeSA-2500 Equipment reference: NEC PC-9801 · 1982 · Intel 8086 · 128KB RAM
Community Ops Bot
$850
3 business days after kickoff and platform credentials
One community. You operate the bot after handoff; ongoing hosting is excluded.
View scope and exclusions
- Included
-
- One Discord or Telegram community
- Up to three commands, two alert sources, and one administrator role
- Privacy policy, deletion path, deployment instructions, one verification pass, and one in-scope revision
- Data posture and exclusions
Only configuration and platform identifiers are stored. Message content is not retained unless the signed scope requires it. Stored platform data is encrypted and deleted when no longer needed; test data and credentials are deleted after verified handoff. Ongoing hosting and operation are excluded. The buyer operates the bot and assumes continuing platform privacy duties after handoff. Signal automation is not offered.
- Price
- $850
- Turnaround
- 3 business days after kickoff and platform credentials
Stripe-hosted checkout books one Discord or Telegram bot within the published limits.
Book this service Ask about the scopeCO-0850 Equipment reference: NEC PC-8001 · 1979 · Z80A · 16KB RAM
WhatsApp Cloud API Bot
$1,500
3 business days after active Meta assets and approved templates are supplied*
Official Cloud API only. Meta approval time and messaging charges are outside the price.
View scope and exclusions
- Included
-
- One inbound workflow and one human handoff path
- Up to three message types, webhook verification, and one deployment target
- Privacy and deletion disclosures for the implemented data flow, one verification pass, and one in-scope revision
- Prerequisites and exclusions
Delivery time begins only after active Meta business assets, a WhatsApp Business Account and phone number, access token, and approved templates are supplied. Meta and template approval time, phone-number activation, and Meta messaging charges are outside the delivery window and price. Only the official WhatsApp Business Platform Cloud API is supported. Ongoing hosting and operation are excluded.
- Price
- $1,500
- Turnaround
- 3 business days*
Stripe-hosted checkout books the implementation after you confirm the required Meta assets are active.
Book this service Ask about the prerequisitesWA-1500 Equipment reference: NEC PC-8801 · 1981 · Z80A · 64KB RAM
Competitor Watch
$299 per month
First brief within one business day of subscribing; then one brief every day*
Up to 20 public pages you name at checkout. Cancel any time through Stripe's billing portal.
View scope and exclusions
- Included
-
- Daily collection of up to 20 public pages: pricing, changelogs, product pages, job boards, anything reachable without a login
- A written brief every day listing exactly which lines appeared or disappeared on each page, with the source URL and collection date
- A plain-language summary of the day's changes, and a note of any page that could not be collected so nothing is silently missed
- Prerequisites and exclusions
List the pages at checkout as full https addresses; you can change the list by email. Pages behind a login, a paywall, a form, or a bot wall are not collected. We never contact the companies you watch, create accounts, or submit forms. The brief reports observed page text; it does not give strategic advice, predict what a competitor will do, or guarantee that every change is caught. The first collection sets a baseline, so differences begin with the second brief.
- Price
- $299 per month
- Cadence
- Daily brief*
Stripe-hosted checkout starts the subscription; the collection begins after the first daily run.
Subscribe Ask which pages qualifyCW-0299 Equipment reference: NEC PC-98LT · 1986 · V50 · 640KB RAM
* WhatsApp timing is counted from the day the active Meta business assets, WhatsApp Business Account and phone number, access token, and approved templates are supplied.
Working together 進め方
A clear handoff
starts here.
A fixed-scope catalog booking uses the published service description and terms. Custom work starts with a conversation and its own written scope.
Choose the published scope
Read the included work, exclusions, delivery clock, refund terms, and prerequisites.
Book through Stripe
Accept the service terms and pay through Stripe-hosted checkout. Stripe sends the receipt and invoice.
Receive the access checklist
Sumihara replies with the exact access and content needed for kickoff. If a kickoff cannot be offered within five business days after payment, you may take a full refund.
Start with the right access
Work begins after payment, agreed access and any required authorization are complete.
Receive the work
The agreed deliverable, a handoff guide and verification.
Cancellation and earned milestones
Full refund before kickoff. After kickoff, only delivered milestones are earned: 20% for the baseline artifact, 60% for the working draft, and 20% for final handoff and verification. These are refund milestones, not installment payments.
If Sumihara cannot meet the stated delivery date, choose a new date or cancel for the unearned refund. Read the complete refund terms before accepting an engagement record.
The person behind Sumihara
Matthew Toro.
スミハラ・プロダクションズ
I work across software and the infrastructure that keeps it running.
My background includes DevSecOps, IT systems and freelance technical consulting since 2023. I have built and maintained self-hosted servers for communities of 24 to 60 users, worked with virtualization, and hardened closed-loop networks.
Bachelor of Applied Science in IT/Cybersecurity and Ethical Hacking, Broward College.
View credentials
CISSP · CCNA · AWS Cloud Practitioner · CompTIA CySA+, Security+, Network+, Linux+, Cloud+ and A+
Start a conversation お問い合わせ
Tell me what
you have in mind.
A project outline is enough. Include your current setup and any deadlines. If you are not sure which service fits, say so.