Technologies
DevOps, testing and security
Every project gets a pipeline that builds, tests and scans the code on each change, and monitoring that tells us about errors before your users do. We use GitHub Actions or GitLab CI, test with Playwright, Cypress and Jest, scan with SonarQube, Snyk and OWASP ZAP, and watch production with Grafana, Prometheus, Sentry and OpenTelemetry.
3 tools
CI and CD
GitHub Actions
Builds, tests and deployments for repositories on GitHub.
GitLab CI
Pipelines for teams on self hosted or cloud GitLab.
Jenkins
Existing enterprise pipelines that we extend.
3 tools
Testing
Playwright
Browser tests across Chrome, Safari and Firefox for key user flows.
Cypress
Component and end user tests in existing Cypress suites.
Jest
Unit tests for business rules and utility code.
3 tools
Security
SonarQube
Code quality and security issues flagged in every pull request.
Snyk
Known vulnerabilities in open source packages and containers.
OWASP ZAP
Automated scans of running apps for common web weaknesses.
4 tools
Monitoring
Grafana
Dashboards for system health, queues and business metrics.
Prometheus
Collecting metrics and raising alerts on thresholds.
Sentry
Error reports with the exact line and user action that caused them.
OpenTelemetry
Traces across services so slow requests can be followed.
What we build with it
Typical work in this stack
- Delivery pipelines
- Every change built, tested and deployed to a staging environment, with production releases one click away.
- Test suites
- Unit tests for business rules and browser tests for the flows that make money, run on every change.
- Security reviews
- Dependency scans, web app scans and a review against the OWASP Top 10 before go live.
- Monitoring and alerts
- Error tracking, uptime checks and alerts that go to the right person, not to everyone.
- Release practices
- Feature flags, database migration checks and rollback steps written down before they are needed.
How we choose
We use the tools already in your organisation where they exist, and add the missing pieces. For new projects we use GitHub Actions, Playwright and Jest, with Sentry for errors, because they are quick to set up and cheap at small scale. We do not chase a coverage percentage. We make sure the rules that move money, stock or personal data are tested, and that the main user flows are checked in a real browser. Automated scans find common problems, but they do not replace a person reviewing access control and data handling, so we do both.
Questions
Good to know
Other parts of the stack
Do you write automated tests on every project?
Yes. The level depends on risk, but business rules and the main user flows are always covered.
Can you run a security review of an existing app?
Yes. We run automated scans, review access control and data handling, and give you a prioritised list of fixes.
Who gets alerted when something breaks?
We agree that before go live. Alerts go to a named person with a clear first step, not to a shared inbox.
Start a conversation
Tell us what you are trying to build.
Share the problem in a short call. You leave with a clear view of the approach, the team and the cost.
A specialist replies within one working day. The first conversation is free.