Skip to main content
Services · Software Engineering

Ship securely, with the team that owns the code.

We put security and quality checks into every pull request, and work with your team until the checks are theirs.

Start a conversation →See the scope
What we do

Most teams have tests and a pipeline. What is often missing is a clear rule for what may reach the main branch, and controls that still hold when nobody is watching. We add both to the way your team already works: checks on every pull request, a hardened supply chain, and limits on what an AI agent can do.

Advisory: We review how the team builds and ships, set up the checks, and leave written guidance the team can follow.

Embedded: We join the team for a period, write code and review pull requests with them, and close the gaps as we find them.

Stacks: .NET and C#, TypeScript and React, Node.js, on AWS and Azure.

What we cover

Four parts of how your team ships code.

01 / Pipeline

Secure SDLC & quality gates

CI that builds, lints, tests and scans every pull request, and a gate that blocks the merge when a required check fails. Each failure links to its fix. Versions come from commit messages, and releases publish from the pipeline, not from a laptop.

02 / Supply chain

Supply-chain security

Your build runs code you did not write. We pin GitHub Actions to commit SHAs, install from a frozen lockfile, turn off install scripts, and keep secrets the pipeline does not need out of its reach.

03 / AI

AI-assisted engineering

Coding agents are fast and will sometimes overreach. We give them their own account, scoped credentials and a container, and move the rules that matter out of the prompt into controls the agent cannot rewrite.

04 / Team

Code review & team growth

Reviews that explain why, and automated feedback while the code is written, so each pull request also teaches. We cut the admin around the work, so developers spend their time on code.

What we assess

Dependencies & supply chain

How many packages you depend on, how updates arrive, whether installs run lifecycle scripts, and whether actions are pinned to a commit.

Secrets & credentials

Where secrets live, which jobs can read them, and what a compromised build could reach with them.

Tests & quality gates

What runs on a pull request, which checks are required, and whether a red result actually stops the merge.

Pipeline & release

How code moves from merge to release: who can publish, how versions are set, and whether each release follows the same steps.

Review practice

Who reviews what, how long a pull request waits, and whether reviews teach or only approve.

What an AI agent may do

What the agent can read, run and push, and which of its rules are only advice in a prompt and which are enforced.

How we work

From a baseline to a team that runs the gate itself.

01

Baseline

We read the pipeline, the repositories and recent pull requests, and run the checks the team does not run yet. You see where you stand before anything changes.

Baseline findings
02

Harden

Quick wins first: pinned actions, frozen lockfiles, install scripts off, secrets scoped. Then we add the missing checks and make the important ones required.

A hardened pipeline
03

Embed

Every pull request goes through the gate. We review with the team, and each red result links to its fix, so people learn the rule from the change in front of them.

Gate result, see the example
04

Hand over

The team owns the gate, the rules and the fix guides. A change to a required check goes through review like any other code.

A team that owns it
What you get

A gate the team reads on every pull request.

  • Quality gate in CI

    Build, lint, tests, coverage and security checks on every pull request, with one result: the change may merge, or it may not.

  • Hardened supply chain

    Pinned actions, frozen lockfiles, install scripts off, and update pull requests the team reads before it merges them.

  • Controls for AI agents

    Settings, hooks and account scopes for coding agents, with a written list of which rules are advice and which are enforced.

  • Fix guides

    A short page for each check: what failed, why it matters, and how to fix it. The gate links to it from the failed check.

PR #482Merge blocked14 Oct

feat(orders): export order history as CSV

orders-api · feat/order-export · 9c41e7a

Failed: 1 of 7 required checks failed. The pull request cannot merge until it passes.

Quality gate

Passed
  1. BuildType-check and production build.Pass
  2. LintFormatting and static analysis on changed files.Pass
  3. TestsUnit and integration tests: 214 passed, 0 failed.Pass
  4. Coverage84% of changed lines covered. The threshold is 80%.Pass

Security gate

1 of 3 failed
  1. Dependency auditNo known advisories in the resolved dependencies.Pass
  2. SAST & secretsSemgrep and Gitleaks: no findings.Pass
  3. Supply chain1 GitHub Action is not pinned to a commit.Fail
    Finding
    The new workflow .github/workflows/export.yml uses actions/checkout@v4. A tag can be moved to point at different code, so the build would run whatever the tag points to that day.
    Fix
    Pin the action to its full commit SHA and keep the version as a comment. Dependabot updates both.uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
An example of the format. Real results come from your own pipeline, on every pull request.

“Inspired by his dedication and engagement to the team and our delivery. Proven technical skills, but also a will to share his knowledge and enable the team to grow together.”

Emelie LundhIngka Group
Related reading
20 Mar 2026

Software Delivery for a Changing System

A practical guide to separating developer concerns, CI, Continuous Delivery, and Deployment, how release manifests work as a master SBOM, and why domain-driven library design holds it all together.

→25 Nov 2025

Securing Your JavaScript Dependencies: What Every Organisation Needs to Know

In November 2025, attackers compromised popular npm packages. The attack didn't exploit a bug. It exploited trust. What happened, why traditional defences fall short, and what you can do.

→03 Aug 2026

Controls Your Agent Cannot Rewrite

Three kinds of control shape what an agent can do, and they are not equally strong. One is advice the model may ignore, one is enforced by the tool, and one is enforced somewhere the agent cannot reach. Knowing which you have written is the whole game.

→
Let's talk

Need to level up a delivery team?

Tell us where the team is stuck. We'll join the team, add the checks that matter, and hand them to the people who own the code.

Get in touch →
Email
info [at] lekman [dot] com
Phone
+44 (0)330 ••• ••••
Office
16 Oughton Head Way
Hitchin, SG5 2LA, UK