Full-Stack Engineering
End to end — architecture, database, API, interface, deployment. PHP and Laravel through to Angular and Node.
Available for new projects
Hi, I'm Deepanshu Kapoor
Full-Stack Developer Security Expert
I design, build and secure web applications — from lean small-business sites to enterprise systems. I've built the frontends behind firewall and IDS/IPS products, so I know how defence is engineered below the app layer: your software ships secure by design, not patched after.
0+
Years experience
0+
Projects delivered
About Me
A developer who thinks like a security expert
Two disciplines, one habit of mind — build it well, then assume someone is already trying to break it.
Twelve years in, I've built at most of the sizes the web comes in — a single-page site for someone who just needed to be findable, brochure sites and online stores for small businesses, internal applications for teams that had outgrown their spreadsheets, and product platforms where an hour of downtime is a number somebody reports upwards. The work changes shape at every one of those scales. What doesn't is working out what the business actually needs before writing a line of it.
What I add on top is a security habit most developers pick up late. I've cleaned up sites after they were compromised and hardened the servers so it didn't happen twice, and spent part of my career building software for network security products — which is where I learned what an attack looks like from the defender's side.
More recently that's grown to include AI features inside products that already exist, and CI/CD pipelines that take the drama out of releasing. I work best with founders and small teams, and I'm as comfortable taking over a codebase someone else started as writing one from scratch.
Security-First Build
Threat modelling, secure code review and hardening baked into the build, not bolted on before launch.
AI Integration
ChatGPT, Claude or Gemini wired into products that already exist — or open-weight models self-hosted when data can't leave your network.
CI/CD Automation
GitHub Actions pipelines that build, test and deploy on merge — so releases stop being an event.
Skills & Expertise
My Tech Stack
Grouped by where each one lives in the stack, from the interface down to the network.
Frontend
React
Angular
JavaScript
HTML5
CSS3
jQuery
AJAX
Backend
PHP
Laravel
CodeIgniter
Node.js
Python
FastAPI
Express
WordPress
AI & Automation
OpenAI / ChatGPT
Claude (Anthropic)
Google Gemini
Ollama · self-hosted
RAG & embeddings
Workflow automation
Databases
MySQL
MongoDB
phpMyAdmin
DevOps & Servers
AWS
Linux
Nginx
Apache
GitHub Actions
Plesk · cPanel
Security & Network
Web App Security
Firewall Systems
Suricata IDS/IPS
OWASP Top 10
Malware Removal
Hardening
Services
Web Development, AI & Security Services
Six things people hire me for — from building an application to cleaning up after someone broke into one.
Full-Stack Web Development
Angular, React, Node.js and PHP applications built end to end — architecture, database, API, interface, deployment. Small business sites through to enterprise systems.
AI-Integrated Applications
Real AI capability added to products that already exist. OpenAI, Anthropic Claude or Google Gemini where a hosted API is the right call — or open-weight models running on your own server when customer data can't leave the network. Either way, automation that removes manual steps rather than a chat box bolted on the corner.
CI/CD Pipeline Design
GitHub Actions pipelines that build, test and deploy on merge — so releases stop being an event and start being a Tuesday.
Secure Web Development
Applications built to hold up in the open: input validation, authentication and access control done properly, and a security review before launch rather than after the incident.
Malware Removal & Hardening
Cleaning compromised sites, closing the way back in, and leaving the server configured so it doesn't happen a second time.
Security Product Frontends
Interfaces for firewall and network security tools — dense configuration screens and alert data made legible to the people on shift.
Selected Work
Web Development & Security Projects
Open-source tools I've built and shipped, plus client work. Problem, approach, and what it actually does.
The problem
Knowing what is actually on a network usually means putting an agent on every host or running active scans that set off alarms. Both are intrusive, and both are a project in their own right before you learn anything.
What I built
A Go tool that reads Suricata's eve.json and correlates protocol metadata — DHCP, ARP, TLS, Kerberos, SMB, SNMP, SSH — into device profiles carrying a confidence score and an evidence trail. No agents, no scanning, no ELK stack to stand up.
What it does
Builds a passive asset inventory, maps users to devices, validates network segmentation policy and flags changes as they happen. Produces self-contained HTML reports and runs on Linux, FreeBSD (OPNsense and pfSense), macOS and Windows.
The problem
Most Microsoft 365 security tools hand you a point-in-time score. They can't tell you whether your posture is improving or quietly sliding — and Microsoft only keeps Secure Score history for about 90 days.
What I built
A multi-tenant Laravel and Vue dashboard that polls Microsoft Graph with application-only authentication, running independent collectors on staggered schedules and taking daily snapshots so history outlives Microsoft's retention window.
What it does
Tracks MFA registered versus actually enforced with separate admin coverage, active Conditional Access policies, and device compliance across Entra ID and Intune — then alerts on configuration drift when a control moves the wrong way. Role-based access, branded PDF reports and scheduled email.
The problem
Software vendors want an AI assistant sitting on their documentation, but sending customer questions to a third-party API is a non-starter for many of them — on cost, on privacy, or on both.
What I built
A retrieval-augmented chatbot that runs entirely on the vendor's own infrastructure: local models through Ollama or vLLM, embeddings via fastembed, vectors in sqlite-vec and sessions in Redis. No API keys, and no data leaving the network.
What it does
Ingests Markdown, HTML, PDF and plain text, then answers with streamed responses and source citations. When retrieval confidence is too low it declines to answer rather than inventing something. Ships as an embeddable widget with custom branding, rate limiting and GPU concurrency caps.
Something like these on your list? Let's talk about it
Testimonials
What Clients Say
The part of a portfolio people actually believe.
Deepanshu came into a brief that kept growing and never once made that feel like a problem. What stood out was how much he caught before it became an issue — permission logic, edge cases in the data model, things we hadn't thought to ask about. He writes code you can hand to the next developer without an apology.
We wanted AI in the product without handing our customers' data to a third party, and Deepanshu was the first person who treated that as a design constraint rather than an obstacle. He shipped on schedule, explained the trade-offs in language our non-technical people could follow, and left us with a deployment pipeline the team actually understands.
We handed Deepanshu someone else's half-finished codebase and a launch date we couldn't move. He read the whole thing, told us honestly what was salvageable and what wasn't, and then got on with it. No drama, no surprises on the invoice, and he was still answering questions weeks after the work was signed off.
Project in mind?
Tell me what you're building — or what's broken. I'll come back within 24 hours with an honest answer about whether I'm the right person for it.
Contact
Let's Connect
Building something new, or worried about something you've already built? Either way, I read every message.