Naveen Upadhyay

48-hour website review

Find the friction costing you trust and signups.

One prioritized audit across conversion, mobile UX, performance, accessibility, and passive security posture.

Request an audit See a sample finding
EXAMPLE AUDIT PRIORITIZED, NOT AUTOMATED
A1
First fix

Remove the conversion blocker before polishing lower-impact details.

  1. P1Primary CTA loses contrast on mobileRevenue
  2. P2Form error has no recovery guidanceUX
  3. P3Security headers need hardeningRisk

Every issue includes evidence, impact, and an implementation-ready fix.

48 hoursStandard turnaround
No scanner dumpHuman-reviewed priorities
Fixed scopeNo surprise invoice
Safe by defaultPassive review unless authorized

Five lenses. One decision-ready report.

I connect what visitors experience with what engineering can fix, then order the work by business impact.

01

Conversion path

Value proposition, CTA clarity, trust gaps, form friction, pricing comprehension, and the path from landing to action.

02

Mobile UX

Viewport behavior, navigation, tap targets, content order, overflow, and real-device breakpoints.

03

Performance

Heavy assets, render blockers, layout shift risks, and practical Core Web Vitals improvements.

04

Accessibility

Keyboard flow, semantics, contrast, labels, focus states, and common WCAG barriers.

05

Passive security posture

Visible configuration, transport, headers, exposed metadata, dependency signals, and privacy cues. No intrusive testing without written authorization.

Sample finding 01

A finding should tell you what to do next.

Generic scores create anxiety. A useful audit identifies the exact surface, explains the consequence, and gives engineering a verifiable fix.

  • Screenshot or reproducible evidence
  • Business and user impact
  • Priority and effort estimate
  • Concrete remediation guidance
  • Verification step
P1 / HIGH IMPACT MOBILE CHECKOUT

Sticky support widget covers the final checkout action

Observed

At 360px width, the fixed widget overlaps the payment CTA and captures taps in the lower-right interaction area.

Impact

Some mobile visitors cannot complete the primary revenue action.

Fix

Move or collapse the widget during checkout, then test at 320px to 430px widths.

Verification CTA remains visible, focusable, and tappable across supported mobile widths.

Technical depth, clearly documented.

Evidence shown here is independent project and research work, not a claim of client engagement or bounty acceptance.

Interactive engineering

3D cybersecurity portfolio experience

Built a 12-phase Three.js facility with recruiter mode, mobile fallbacks, reduced motion, persistent mission state, and an automated end-to-end completion test.

Verified at desktop and 390px mobile with no browser errors.
Security research

Web, API, MCP, and smart-contract analysis

Maintained structured research archives with attack-surface maps, reproducible proof of concept material, severity reasoning, and remediation-ready reports.

Public-safe excerpts available after disclosure review.
Defensive analysis

Malware triage and detection artifacts

Performed static PE analysis, extracted indicators, classified an obfuscated NanoCore RAT sample, and produced a YARA detection rule.

Analysis used isolated samples; dynamic execution was not performed.

From URL to priorities in three steps.

  1. 01

    Confirm scope

    You share the URL, conversion goal, audience, and any known constraints. Active security testing is excluded by default.

  2. 02

    Review the real journey

    I inspect key pages across desktop and mobile, gather evidence, and separate symptoms from root causes.

  3. 03

    Receive the fix order

    You get a concise report, a walkthrough, and an optional fixed-price implementation quote.

Pilot availability

Small enough to try. Useful enough to act on.

Pilot pricing is limited to the first two public case-study projects. Publication requires separate approval.

FOUNDING PILOT $49 or INR 2,999
  • Up to 5 public pages
  • Desktop and mobile review
  • Top 10 prioritized findings
  • Annotated evidence
  • 30-minute delivery walkthrough
  • One follow-up clarification round
Request an audit

No intrusive security testing. Implementation is quoted separately.

Clear boundary, before any work starts.

Included by default

Public-page UX, conversion, accessibility, performance signals, visible configuration, privacy cues, and non-invasive security observations.

Requires written authorization

Authenticated testing, active scanning, API manipulation, fuzzing, exploit validation, source review, or any interaction beyond normal public use.

Two pilot slots

Send the URL. I will confirm the scope first.

Email the brief