twofed is the independent practice of Pavel, a senior engineer based in Spain. Getting software live is easy now: AI can build it in days. Keeping it secure, fast and running is the hard part. I audit code and infrastructure, fix what's broken, rescue AI-built and legacy apps, and keep them maintained month after month.
Platforms and stacks I work with:
01Your audit
A focused look at where your app could lose money or leak data.
Fits if you're afraid of a hack or a data leak, payments or orders sometimes fail or go missing, or the same errors keep coming back.
A full review of one product, with a written report and a plan.
Fits if you can't tell if it's built stable, your developer left and nobody knows how it works, you're about to grow and it has to hold up, or you're not sure you can rely on your system.
After the audit, if you want: Find & fix (2–6 weeks, at a fixed quote based on the audit), then monthly maintenance from €250/month excl. VAT.
Not sure which one? Ask me on WhatsApp or by email.
Prices exclude VAT. The full-coverage audit starts at €3,700 for several services or databases. No obligation to hire me for the fixes. WhatsApp @twofed (messages only, in English). How I handle your data
Tick what sounds like you to see which audit fits and its price.
Your message, opens as a draft you can edit:
02Prices
Start small: a one-day critical audit or a full-coverage audit, with read-only access and no obligation to hire me for the fixes. No hidden fees and no surprises: if the work turns out bigger than planned, I tell you first and you decide. That's the point of an audit, too: fewer surprises in your software.
Every engagement starts with a clear picture of your system. Not sure what you need? Start with the one-day critical audit, or see a sample audit report.
€600
1 working dayA focused look at where your app could lose money or leak data.
from €1,900
1–2 weeksA full review of one product, with a plan you can hand to any developer.
Looks right. How do we start? (full-coverage audit, on WhatsApp)
Fixed quote
2–6 weeksFixing what the audit found, then new work, each with a fixed scope and price.
Maintenance
Think of it as a family doctor for your software: regular check-ups so little goes wrong, and when something does break, you don't have to explain your system to a stranger. Work starts the same working day on any plan and comes out of your plan, instead of €110/hour paid up front. How much care you need depends on how often your software changes.
€250/month
For stable software that mostly needs looking after.
That's us, let's set it up (Steady maintenance, on WhatsApp)
€590/month
For software that keeps changing but not every week.
Sounds like us, let's talk (Active maintenance, on WhatsApp)
€1,250/month
For frequent releases: more time each month, and every release checked.
We ship weekly, let's plan it (Fast-moving maintenance, on WhatsApp)
03Toolbox
04Who am I
Behind twofed is me, Pavel — a senior software engineer with more than a decade of commercial experience. I've built and run systems in PHP, Node.js and Python, with React on the front end, Rust where performance matters and a lot of database work underneath.
Over the years I've learned that the hard part of software isn't writing it. It's keeping it secure, fast and understandable once real users and real data arrive. That's the work I focus on: careful audits, honest estimates, fixes that last and documentation the next engineer can follow.
I'm based in Spain and work remotely with clients all over the world. My working hours are 10:00–19:00 CET, which overlaps with business hours across Europe and with mornings on the US East Coast.
Anonymised examples of audits, fixes and maintenance, published with the clients' written approval.
Audit · Industry, country
Placeholder. Who the client was, what was going wrong and what I did about it, in two or three sentences.
Stack:
Find & fix · Industry, country
Placeholder. Who the client was, what was going wrong and what I did about it, in two or three sentences.
Stack:
Maintenance · Industry, country
Placeholder. Who the client was, what was going wrong and what I did about it, in two or three sentences.
Stack:
05FAQ
Yes, that's a large part of my work. AI-generated code is often fine to start with, but it tends to skip the boring parts: access control, error handling, tests, backups and monitoring. I review what you have, keep what works and fix what doesn't, usually without a rewrite.
Rarely. Most systems can be stabilised step by step while the business keeps running. If a rewrite really is the cheaper option, the audit will show it with numbers.
Yes. I start with a one-day critical audit or a full-coverage audit so we both know what we're dealing with before I change anything (for a PHP upgrade on its own, the free estimate is enough). Then I document what I learn, so you never depend on one person again, including me.
Only if it has the October 2026 security fixes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or a patched package from your Linux distribution, which may keep an older version number. PHP 8.2 gets security fixes only until 31 December 2026, and 8.1 and older no longer get regular releases. I give a free estimate of what it takes to move your site or app to a supported version: PHP upgrade estimate.
For the audit, read-only access is usually enough: the code repository, hosting and the database structure, or a copy you have anonymised. Please don't send a copy with customer data. For the load test, I also need a test copy of your system, such as a staging environment: I never load-test the live one. I sign your NDA and a data processing agreement (Art. 28 GDPR), use separate credentials, and return or delete access and data when we're done.
Monitoring runs around the clock and alerts me automatically. I work 10:00–19:00 CET on business days and, during those hours, reply to urgent messages within 2 hours. If you need cover outside those hours, we agree it separately.
The one-day critical audit is €600. If you go on to the full-coverage audit, it costs less, because part of the system is already reviewed. The full-coverage audit starts at €1,900 for one product and at €3,700 for systems with several services or databases. Find & fix work gets a fixed quote based on the audit. Maintenance is €250, €590 or €1,250 a month. Emergency fixes are €110 an hour with a two-hour minimum, or come out of your plan if you're on maintenance. Prices are for businesses and exclude VAT. If your budget is already set, tell me and I'll propose what fits into it.
Yes — all of my work is remote. I'm based in Spain and work with companies across the EU, the UK, Switzerland and further afield. I'm used to asynchronous communication, shared Slack channels and calls between 10:00 and 19:00 CET.
Everything is official: I'm a registered self-employed professional (autónomo) in Spain and issue proper invoices in EUR. EU businesses with a valid VAT number are invoiced under the reverse-charge rules. Audits and emergency fixes are paid up front, find-and-fix projects half up front and half on delivery, and maintenance monthly in advance, by bank transfer.
Most likely, if you sell products or services to consumers online in the EU — online shops, bookings and tickets, banking services or e-books. Since 28 June 2025 these must meet accessibility requirements based on WCAG 2.1 AA, and you have to publish how your service meets them. Microenterprises with fewer than 10 employees and up to €2 million in annual turnover are exempt. The audit covers the basics; for legal questions about your specific case, please talk to a lawyer.
06Contact
What your system does, what it's built with and what's going wrong. I reply to every message within one business day, and to urgent ones within 2 hours during working hours. WhatsApp @twofed (messages only, in English).