Secure Your Software
Security architecture, data integrity, and compliance consulting. We help organizations eliminate identity debt, implement cryptographic guarantees, and meet regulatory requirements.
Our Services
Security consulting and software development. We protect the applications you already run, and design, build, and ship the ones you need next.
Forensic Identity Audit
A standard code review looks for bugs. A Forensic Audit looks for “Authority Leakage.” We deep-dive into JWT validation, claim-mapping, and permission logic to find the vulnerabilities that attackers actually exploit.
Security Assessment
Learn more →
Compliance & Audit Readiness
Audit fatigue is real. We help teams move from “Fire Drills” to “Always-Ready” by baking compliance into code through automated verification, OSCAL documentation, and privacy-first PII handling.
SOC2 / HIPAA / GDPR
Learn more →
Secure Infrastructure
From tamper-evident audit logs to automated secret rotation and break-glass access protocols. We implement the cryptographic foundations that compliance frameworks require.
Implementation
Learn more →
M&A Technical Due Diligence
We help private equity firms and acquiring companies audit the “Security Debt” of a target .NET platform before they buy it.
Acquisitions
Learn more →
Fractional Identity Architect
Your team ships features. We ensure your security posture doesn't drift. Monthly retainer for identity PR reviews, Key Vault health checks, and architecture guidance.
Ongoing Support
Learn more →
Software Development
New builds, feature work on systems already in production, and modernization of platforms that have outgrown their design. Health and safety platforms, payment processing, LMS integrations, all designed, built, and deployed end to end.
Build / Extend / Modernize
Learn more →
Our Work
Custom software delivered for clients, commercial products we run ourselves, and what we give away. Every system below is live and carrying real work.
6
Systems shipped
2
SaaS products we own
2
Published CVEs
MIT
Open source, free
Custom Software
Built for clients and still running: architecture, implementation, infrastructure, and release.
CorrectTrack
Workplace health and safety incident tracking, hazard analysis, inspections, and compliance reporting, replacing manual regulatory paperwork with a repeatable, auditable workflow.
Healthcare / Compliance
Read the case study →
Executive Storage Suites
Storage facility inventory, tenant records, and leasing, with e-signed leases, SMS notifications, and automated recurring billing through a tokenized payment gateway.
Property Management / Fintech
Read the case study →
Burrus
Feature work on a learning management platform already carrying the business: integrations, reporting, and workflow enhancements built within an existing codebase and its existing conventions.
Education / Enterprise
Read the case study →
Products
Commercial SaaS we designed, built, and operate ourselves: billing, authentication, infrastructure and all.
POOF
Build apparel proofs from live wholesaler catalogs, send one link, and collect customer sign-off sealed with an RFC 3161 cryptographic timestamp, so a disputed approval produces evidence instead of an argument.
SaaS / Apparel Decoration
Read the case study →
Alectryon
Workforce time tracking for small and mid-sized teams: clock in and out, shift scheduling, time-off accrual, and timesheets that export to payroll and sync to QuickBooks. Multi-tenant, role-based, billed per seat.
SaaS / Workforce Management
Read the case study →
Open Source
Starbase
A secure, enterprise-ready .NET API template with Clean Architecture. Batteries included.
dotnet new install StarbaseSecurity (Production-Ready)
- JWT Authentication with secure refresh token rotation
- Multi-Factor Authentication (TOTP, Email, WebAuthn/Passkeys)
- Rate Limiting with per-endpoint policies
- Account Lockout with exponential backoff
- Security Headers (CSP, HSTS, X-Frame-Options)
Enterprise Features
- Hash-chained audit logging with SQL Server partitioning
- Kubernetes-ready health checks
- Serilog + OpenTelemetry observability
- Multi-stage Docker builds with non-root user
- Clean Architecture with four layers
Philosophy: Secure by default. If a 3-person startup can ship with MFA, rate limiting, and proper audit logging, the world has better cybersecurity.
About Us
Red Cardinal Software is a security consulting firm specializing in .NET platform security and identity architecture. We help organizations eliminate vulnerabilities in authentication, authorization, and compliance before they become breaches.
We bring experience from startups and enterprises alike, and understand that security must enable business, not hinder it.
Published Research
Our security research has resulted in published CVEs through our sister MSP company, Sparrow IT Solutions:
- CVE-2025-9037
- CVE-2025-9040
Expertise
Deep knowledge of secure development practices and compliance frameworks
Clarity
Clear, actionable recommendations you can implement immediately
Partnership
We work alongside your team, not as outside critics
Get in Touch
Ready to improve your security posture? Let's discuss how we can help.