fcsac

I build, fix and take apart software.

Freelance developer, EU-based. C++, C#, JavaScript and TypeScript, Lua, Python and whatever else your project runs on: desktop tools, websites, backends, bots and game servers, plus reverse engineering and security work. You get a fixed price before anything starts, and source code you own when it's done.

Work

Building

  • Desktop and native

    C++, C#, .NET, Visual Studio

    Windows tools and utilities. C++ where speed or low-level access matters, C# and .NET for everything else. New builds or fixes to an existing workspace.

    You get the full solution, build steps and a compiled release.

  • Websites and frontends

    HTML, CSS, JavaScript, TypeScript

    Landing pages, portfolios, dashboards and panels. Broken layouts fixed, slow pages sped up, everything working on phones.

    You get a responsive site, deployed or handed over.

  • Backends and APIs

    Node, SQL, nginx, Linux

    Node APIs, databases, logins, admin panels and the glue between services, on your server or a new one.

    You get a running service with setup notes.

  • Game servers

    Lua, Luau, ESX, QBCore, ox

    FiveM resources and Roblox systems, server-authoritative from the first line, plus resmon and performance fixes.

    You get full source you own, with config and setup notes.

  • Bots and automation

    Discord, Python, Node

    Discord bots, scripts that take over repetitive work, scrapers and small pipelines that run on their own.

    You get a running bot or script, hosted or handed over.

Breaking and securing

  • Reverse engineering

    x86/x64, PE/ELF, protocols, file formats

    Binaries, protocols and file formats taken apart: how a program works, what a closed tool sends over the network, why a DLL crashes. Only on software you own or are allowed to test.

    You get a written breakdown, plus a working parser, client or patch where needed.

  • Anti-cheat and anti-tamper

    C++, Windows internals, Lua

    Detection for injected code, memory edits and modified clients, backed by server-side checks so cheats have nothing to grab.

    You get detection and logging, with ban hooks for your staff.

  • Security audits

    Code review, web, native

    Code reviewed for the holes attackers actually use, in game scripts, web apps, APIs and native code.

    You get findings ranked by severity, each with a fix.

  • Server hardening

    Linux, nginx, SSH

    Linux servers locked down: firewall, SSH keys, fail2ban, closed database and panel ports, and services that run without root.

    You get a list of every change and why, with the old config backed up.

Something that doesn't fit here? Describe it in a brief and you'll get a straight answer on whether I can do it.

Most exploits are one missing check

Modified clients, mod menus and a single curl command can send your server anything. An audit goes through every place your code trusts outside input and asks what happens if that input is a lie.

  • Server code that trusts prices, amounts, IDs or roles sent by the client
  • Endpoints and events with no permission or ownership check
  • No rate limits or cooldowns, so anything can be spammed
  • Responses that leak other users' data
  • SQL built by joining strings instead of ? parameters
  • User input rendered as HTML, open to script injection
  • Secrets left in client code, repos or public files like .env
  • Admin panels and database ports open to the internet
High shop:buyItem trusts the client's price server/main.lua:42 
RegisterNetEvent('shop:buyItem', function(item, price)
    local xPlayer = ESX.GetPlayerFromId(source)
    xPlayer.removeMoney(price)        -- client's price
    xPlayer.addInventoryItem(item, 1) -- any item
end)

-- what a mod menu sends:
TriggerServerEvent('shop:buyItem', 'goldbar', 1)

Fix: look the price up on the server in Config.Items[item], reject unknown items, check the player is standing at a shop, and add a one-second cooldown.

An example of the report format, from a FiveM script. Illustrative code, not from a client.

This server, last 24 hours

Straight from the logs of the server you're reading this on. Loading the numbers…

Paths scanners tried most
PathHits
Loading…

Only totals are published here, never addresses. Updated every minute. What the logs keep is in the privacy policy.

From brief to handover

  1. Send a brief

    The language or framework, what you need, and your deadline. Code, a repo or screenshots help.

  2. Fixed price

    A price and a timeline, agreed before any work starts.

  3. The work

    Updates as it goes, and questions when something is unclear.

  4. Handover

    Source code, notes on what changed, and a check that it runs on your setup.