DevSecOps & CI/CD
Centralized pipelines whose security gates contributors cannot skip.
- Code and image scanning (Trivy, semgrep, gitleaks)
- Pinned, reproducible builds and promotion by digest
- SBOM (CycloneDX) and VEX for client reviews
IT Consulting · DevSecOps · Software Development
We find vulnerabilities, secure delivery pipelines and operate production platforms.
Tadlas LLC tests applications for exploitable vulnerabilities, builds security-gated CI/CD pipelines, hardens infrastructure, responds to incidents and develops software.
- Wyoming LLC
- Remote delivery
- Quotes in USD
- Fixed price or time & materials
Services
What we do
Engagements are scoped in writing, delivered remotely and documented so your team can run what we build.
Penetration testing & application security
We find real, exploitable vulnerabilities in your applications, prove them and help you fix them.
- Penetration testing of web applications and APIs
- Authentication, access control and business-logic testing
- Source code review, fix validation and retest
Cloud & infrastructure
Infrastructure as code for segmented, often offline, production networks.
- Ansible and Terraform, Proxmox, private cloud (OpenStack)
- DMZ segmentation, internal PKI, TLS and mTLS
- Hardening against public baselines (ANSSI, OpenSCAP)
Observability & incident response
Monitoring that is itself secured, and diagnosis from evidence when things break.
- Prometheus, Loki, Grafana, Alloy with mTLS ingestion
- Alerting reduced to actionable signals
- Performance incidents, emergency patching, backups and restore tests
Software & web development
Web applications, APIs and internal tools, delivered with the same reviewed, scanned process.
- PHP/Laravel, React/Next.js, Python
- Secure file uploads, signed downloads, deployment tooling
- Tests, documentation and secure defaults
Security baselining & compliance evidence
Measurable hardening and the documents a client or regulator review asks for.
- Hardening measured against ANSSI-BP-028 with OpenSCAP
- Documented list of deviations, with reasons
- Evidence package for client or regulator reviews
Engagements
Typical engagements
Six common ways to start. Each ends with deliverables your team can run and audit.
Secure CI/CD
- Typical need
- Code reaches production without consistent security checks, or contributors can change the checks themselves.
- What we deliver
- Centralized pipeline definitions, code and image scanning, pinned builds, promotion of the same image from test to production, a traced approval before production.
- You receive
- Working pipelines, a documented exemption process and a runbook for your team.
Deployment on segmented networks
- Typical need
- Applications must run in DMZ-segmented or offline networks under strict change control.
- What we deliver
- Ansible deployments with internal PKI, TLS and mTLS between components, hardened reverse proxies and containers, backup before deployment and automatic rollback.
- You receive
- Infrastructure code in your repository, flow matrices and deployment procedures.
Hardening & compliance evidence
- Typical need
- A client or regulator asks for proof that systems are hardened and dependencies are known.
- What we deliver
- Hardening against a public baseline (ANSSI-BP-028, measured with OpenSCAP), SBOMs with VEX statements, documented deviations.
- You receive
- Scan reports, a list of deviations with reasons, and the configuration as code.
Penetration test
- Typical need
- You need an independent test of your application or API before a launch, an audit or a client security review.
- What we deliver
- Manual testing within a written scope and authorization (authentication, access control, injection, business logic), supported by code review where source is available.
- You receive
- A prioritized report with proof of each vulnerability and remediation guidance, then a retest of the fixes.
Monitoring, backup & DR
- Typical need
- Problems are discovered by users, and backups have never been restored.
- What we deliver
- Prometheus, Loki and Grafana with secured ingestion and actionable alerts; encrypted off-site backups with tested restores.
- You receive
- Dashboards, alert rules, backup jobs and a written restore procedure.
Incident & performance diagnosis
- Typical need
- A platform is slow, unstable or exposed to a newly published vulnerability.
- What we deliver
- Diagnosis from logs and metrics, the smallest safe fix with a rollback path, emergency patching through your normal pipeline.
- You receive
- The fix, an incident report with evidence, and follow-up actions for your team.
About
A small company, an experienced engineer
Tadlas LLC was founded and is led by Zakariaa Oulhafiane, a DevSecOps engineer and penetration tester who works remotely from Morocco. He has been finding and reporting vulnerabilities in client applications for years, through manual testing and code review.
For larger engagements, Tadlas works with a network of independent (freelance) engineers and sizes the team to each project. The founder leads every engagement and tells you who else is involved.
- Company
- Tadlas LLC, a Wyoming limited liability company
- Activity
- IT Consulting, Software & Game Development
- Founder
- Zakariaa Oulhafiane
- Team
- Founder, plus freelance engineers per engagement
- Location
- Remote, from Morocco
Tech stack
Tools we use in production
Delivery
Security
Infrastructure
Observability
Data
Development
Also available
Applied AI
-
Available, growing
AI-assisted security workflows
AI-assisted review, triage and documentation workflows that fail closed, including fully on-premise deployments. We run LLM-assisted security reviews in CI pipelines.
Tell us about your project
Send a short description of your platform and what you need. We usually reply within two business days.
contact@tadlas.com- contact@tadlas.com
- Company
- Tadlas LLC, a Wyoming limited liability company
- Mailing address
- 30 N Gould St Ste R, Sheridan, WY 82801, United States