iziwerk — the product

The spine of the whole thing is Row-Level Security — confidentiality enforced in the database, not in app code that could carry a bug. A client on one project physically cannot read another client's invoices, files or messages, even with a valid token hitting the API directly. And I didn't take that on faith. Every phase shipped with an adversarial isolation test — a script that logs in as a hostile tenant and tries to break in, asserting every attempt is denied.

Passwordless by design. Freelancers get a mandatory authenticator (TOTP) plus optional passkeys and saved recovery codes; clients get a frictionless magic link with optional TOTP — invite-only, always. The recovery path is built so an email inbox can never be a single master key.

The ones that matter are the unglamorous ones: privilege columns like plan and is_admin that are physically un-writable from the client and only ever set server-side; a white-label flag generated off the subscription tier so it can't be forged; payment status that changes only on a verified webhook, never on a browser redirect; uploads that can't be bypassed with a direct storage call. Every one of those is asserted in the test suite.

The feature I'm proudest of. One variable-driven system renders every document a freelancer sends — proposals, invoices, quotes, contracts, receipts — in three styles the user picks, in their own branding, exportable to PDF. Free and mid tiers ship a tasteful default; the top tier unlocks full white-label — the same identity system, swapped by a few tokens. Seventeen types, three styles, two brand modes.

Every architectural and product call here is mine, and so is every decision to reject one. I ran an AI-orchestrated pipeline to build against those calls — a planning layer that turned intent into exhaustive build instructions, an implementation layer working in plan-then-review-then-execute cycles — and I sat in the middle red-teaming every plan and running the verification myself. The judgment and the refusal are the scarce parts. When the isolation gate came back one assertion short of clean — 160 of 161, at the size the suite was then — I didn't ship it. I found the one, fixed it, and re-ran until every assertion passed. Nobody was waiting on that decision but me.

The obvious question is why you'd need me rather than the same tools. This is what the tools produce without a verification layer on top: a privilege column that looks completely plausible and is writable from the client; a payment status that flips on a browser redirect instead of a signature-verified webhook; a storage rule that holds in the UI and not against a direct API call. Every one of those reads fine in review and fails the moment somebody hostile looks at it. Catching them is not a prompt — it's knowing they're the things to go looking for, and refusing to sign off until each one is asserted in a suite that runs again on every change.

Then I turned the same rigour on my own finished product. A read-only adversarial audit swept the whole thing — every surface, every claim, refute-by-default — and surfaced 355 findings. Not a single one was hand-waved: I fixed every one across a twelve-pass remediation program — double-charge and GDPR-deletion gaps, gameable reputation and referrals, an unguarded delete path, and, tellingly, a broken invite-redemption bug the isolation suite caught the instant it ran again. The suite ended at 556 / 556, green against the live database. Auditing your own work as ruthlessly as a hostile reviewer would is the difference between "it demos" and "it holds."

The product is live. Stripe checkout runs in production, and Terms and Privacy v1.0 have been in force since 9 July 2026. Both halves were built and shipped on their own infrastructure — the freelancer workspace, and the hiring board that sat on top of it. The claims above aren't aspirational: 556 isolation assertions green against the live database, every one of the 355 audit findings closed, and the suite re-runs with every change that touches the spine. The company behind it is registered, with the usual paperwork tail still closing. Scope moves after launch, so read this page as a record of what was built rather than a current feature list. The hard, easy-to-get-wrong part — building both sides of a market on one secure spine and having it survive its own audit — was done.