Problem
- A new application at the start of development.
- Had to meet market regulation on data processing.
- Needed full coverage: architecture, threat modeling, secure development, pentests, infrastructure and vendor audits.
CaseStudies
Real projects, real results: from secure architecture reviews and railway reports to a DevSecOps team built from scratch and 50 microservices kept running.
Our work
Four projects, four ways we deliver.
Our clients' satisfaction is our pride. Each case shows the problem, what we built and how it ended — and how we could work with you.
01Threat Modeling & DevSecOpsSecure Development & Architecture ReviewA full cybersecurity audit of a new application before launch, so it met data-processing regulations from day one.2 months · Fixed priceRead the case
02Railway systemsRailSoft EngineeringCustom reports in the RailSoft system giving field engineers and management one view of railway data — plus technical ownership of the enova360 integration.6 months · Time & material with capRead the case
03DevOps & SecOpsDevOps & CybersecurityA brand-new DevOps & SecOps team for an insurance project: CI/CD, environments and security gates, fully automated with GitOps.12 months · Time & materialRead the case
04B2B / B2CMicroservices Development and MaintenanceTeam extension for Urban, a marketplace and business software for wellness practitioners: about 50 microservices, mobile and web, with on-call support.10 months · Time & materialRead the case
Case 01
Secure Development & Architecture Review
A full cybersecurity audit of a new application before launch, so it met data-processing regulations from day one.
Domain
- Threat Modeling & DevSecOps
Services
- Architecture review · Threat modeling · AppSec
Period
- 2 months
Method
- Fixed price
Solution
An audit of the designed architecture, set out in a Scope of Work and run with manual and automated methods. Documentation, video calls and Q&A sessions fed it — precise results with time and cost under control.
Tools & frameworks
- OWASP Top 10
- OWASP ASVS
- OSSTMM
- SAMM
- DSOMM
- STRIDE & DREAD
- MITRE
Project execution
- 01Scope & basic information
- 02Data flow diagrams (C4 model)
- 03Information gathering
- 04Data in the cloud
- 05Vulnerabilities & threat modeling
- 06DevSecOps maturity modeling
- 07Report & presentation
Result
- Realistic pricing from a work breakdown structure.
- Plan delivered on agile milestones.
- Report on design, architecture, deployment and every security control.
- All potential vulnerabilities and threats identified and rated.
- A recommendation for every flaw found.
Case 02
RailSoft Engineering
Custom reports in the RailSoft system giving field engineers and management one view of railway data — plus technical ownership of the enova360 integration.
Domain
- Railway systems
Services
- Railway system engineering & management
Period
- 6 months
Method
- Time & material with cap
Problem
- No single source of truth on railway data for engineers and management.
- Slow, costly report extensions from the vendor.
- An enova360 + RailSoft integration that needed a technical owner.
Solution
We analysed the system and database through workflow tests and profiling, found how to extract the data, then built reports optimised for big data chunks.
Tools & frameworks
- RailSoft
- enova360
- MySQL
- Web services
Project execution
- 01Scoping and report overview with the client
- 02Fleet maintenance report, tracking deviations from Polish norms
- 03Detailed odometer indicators report
- 04Combined faults & defects report
- 05Review of the enova360 integration and data flow
Result
- Reports tested and approved — better locomotive fleet management.
- Flaws and data-coherence issues in RailSoft found and reported.
- Parameterised MySQL queries and reports on the test platform.
- A migration plan to production.
- Reviewed integration quotes and a web service / data flow proposal.
The work was performed successfully. Reports allowed us to identify key areas for improvement.
Case 03
DevOps & Cybersecurity
A brand-new DevOps & SecOps team for an insurance project: CI/CD, environments and security gates, fully automated with GitOps.
Domain
- DevOps & SecOps
Services
- CI/CD · AppSec · Security testing
Period
- 12 months
Method
- Time & material
Problem
- The client's first DevOps team — CI/CD, environments, dev support.
- SAST had to block code with bugs, low test coverage or vulnerable dependencies.
- Container images scoring above 7 CVSS could not reach higher environments.
- Performance tests and internal security tests to run on top.
Solution
GitLab CI pipelines deploying to Kubernetes on a private OpenShift cloud, scanned by Advanced Cluster Security. Environments split with kustomize overlays, deployed via GitOps with Argo CD; pentests with Nikto and Burp Suite.
Tools & frameworks
- GitLab CI
- Kubernetes
- OpenShift
- Argo CD
- kustomize
- SonarQube
- ACS
- JMeter
- Nikto
- Burp Suite
Project execution
- 01Shared CI/CD definitions in one repository
- 02SAST for micro-frontends and backends
- 03Deployment repositories for GitOps
- 04Automatic deploys to development
- 05New environments, weekly production releases
- 06Automated JMeter performance runs
- 07Internal security tests
Result
- Every deployment automated and secure, end to end.
- Vulnerable code and images stopped before production.
- Key areas for security improvement identified.
- The client freed to focus on its core business.
Embedding DevSecOps role is not an easy going task and yet it was performed successfully.
Case 04
Microservices Development and Maintenance
Team extension for Urban, a marketplace and business software for wellness practitioners: about 50 microservices, mobile and web, with on-call support.
Domain
- B2B / B2C
Services
- Microservices development & maintenance
Period
- 10 months
Method
- Time & material
Problem
- A web & mobile platform with high engineering standards to keep.
- Needed a stable team extension with principal-level competency keepers.
- Ownership of ~50 microservices, mobile and frontend, plus on-call.
Solution
We analysed the needs and the system, then filled each role directly — including a project-management extension — in a close, high-level partnership with on-call support.
Tools & frameworks
- Google Cloud Platform
- TypeScript
- Native mobile
- JavaScript
Project execution
- 01Multi-disciplined engineers across design, engineering and testing
- 02Continuous integration and peer review
- 03Test automation
- 04Replicable deployments
- 05On-call support
Result
- A stable, reliable team with principal-level competency keepers.
- Microservices, mobile and frontend delivered and maintained.
- The client took its business to the next level.
We have gained a stable and trusted partner we can count on.
Tell us about your needs.
Schedule a free expert session on delivering secure software, or ask about a team, an audit or the Grow Together program.
- E-mail: office@4code.io
- Phone: +48 737 882 113
- 4CODE
Sucha 3/2p
50-086 Wrocław, Poland