The Laravel project is late, the customer is waiting and the team is full: a senior who joins your repository and aims at the first feature in a pull request within the first week

Do you recognise at least two of these?

• A delivery is late and you cannot hire for a three-month peak.
• A customer's codebase arrived without tests, and every change breaks something else.
• A migration (Laravel, PHP or database version) is needed and nobody wants to start it.
• A customer asks for a penetration test or a security questionnaire and nobody has time for it.
• The last freelancer delivered his own way, and the lead spent a month tidying up.

If you said yes at least twice, the problem is not finding a developer: it is finding one who fits your standards without costing the time you wanted to save.

What a week of delay costs

• A stalled project burns margin every week and moves everyone else's dates.
• A waiting customer does not renew, or renews asking for a discount.
• The wrong freelancer costs twice: his days and the lead's days redoing them.
• An authorisation bug in production costs the customer, not the ticket.

With these numbers, the day rate is the small part: the big part is how fast the person becomes productive and how little he makes the others work.

What if the first week ended with a green pull request?

That is how the first week goes. Day one: clone, local environment, a read of the code and the tests, a written list of what is clear and what is not. By Friday: one real feature closed up to the pull request, tests and static analysis green, reviewed by your lead. From there the pace is yours: sprints, kanban or tickets.

Tools and standards are yours (Git, CI, issue tracker, chat). If they are missing, a one-page proposal arrives and is applied only after your go-ahead. What you keep every time:

• Pest or PHPUnit tests around every feature touched; coverage measured in CI.
• PHPStan at the maximum level on new modules, a baseline on the rest that can only shrink.
• Mutation testing (Infection) on critical modules: tests must fail when the code changes.
• One small pull request at a time, with what changes and why written down.
• Delivery with written architecture decisions, runbook, no secrets in the repository.

Three recent engagements, with numbers

• Full refactoring of a legal-tech platform, on behalf of a software house, March to December 2025, time and materials: at the end, automated tests, mutation testing and static analysis in CI. The code can be touched without fear, and every following change costs less.
• MVP of a GDPR consent management system for a Milan startup: a product complex above all in its data model, working in 6 months, built solo; a collaboration that lasted two years.
• Laravel projects for a software house with small customers, since 2019: continuous delivery inside their repository, with their conventions, without replacing the team.

Behind it: fourteen years of PHP and Laravel since 2012, tech lead of a software house until 2025, and the same discipline applied to own products (tests, static analysis, blocking CI). End customers are not named: details, with references, on request.

Rates, availability and the first step

Day or project basis, written quote before starting. Rates in line with the European freelance market (Malt, UK and German benchmarks 2025-2026):

• Senior Laravel engineer inside your team: €450 per day, at least one day a week, long term included; invoiced monthly, paid by card or SEPA through Stripe. Terms and market benchmarks on the day rate page.
• Application security and penetration testing: €700 to €900 per day, report included.
• Applied AI and industrial systems (vision, MES, machine integration): €850 to €1,100 per day.

Ongoing engagements take the days of the week on the calendar: when the days are taken, they are taken. The right step to find out whether it makes sense is small: describe the real project and give me read access to the repository; you get a written estimate of the first week, even if you then choose someone else.

Contact us.

Software security: audit, fixes, penetration testing, NIS2

On the same page, because it is the same person and the same method: software security is a cross-cutting capability, not a separate service. You need it when a customer sends you a security questionnaire, when the system you sell was written by someone years ago, or when NIS2 asks for an answer inside the code too.

• Code and dependency audit: access control, input, sessions, configuration, outdated libraries; a written list with priorities.
• Remediation in the code: fixes come with regression tests and checks that stay in your CI, not in a PDF.
• Application penetration testing with the OWASP method on the system you use or sell, 3 to 8 days depending on the functions, report included.
• NIS2 support on the software side: in Italy the basic measures must be in place by 31 October 2026; for software that means penetration testing, fixes and evidence to show the audit. The organisational part stays with your consultant.

Rate: €700 to €900 per day, report included; fixes are quoted after the report, in writing. Details on the NIS2 application security and penetration testing page.

Outside client projects: JavaScream, an open-source project, and articles on application security published on Red Hot Cyber. Reviews from people who worked with me on these topics are below.