Romain Costes

Lead full-stack developer & tech lead

I design, ship, secure and monitor production websites, from custom themes all the way down to the server.

Based in Lisle-sur-Tarn · Toulouse, France Available for full-remote, permanent roles Hover to inspect the code Scroll
Manifesto

The dev you call when it has to hold. Custom themes and modules, stores migrated without losing a single order, compromised servers set straight, in-house tools watching over everything else. An apprentice to help grow, well-scoped AI agents, and one rule: nothing is concluded without proof.

By the numbers
  1. 5+ yrs

    of sites in production, from code to server

  2. 100+

    client sites built, hosted and maintained

  3. 47

    client projects in six months, with full technical ownership

  4. 44

    sites monitored by my in-house tool, 99.86% uptime

Case study · anonymised

One intrusion, from alert to healthy prod.

A compromised online store, an attacker who had been inside for months. Scroll to follow the investigation.

  1. 01Detect
  2. 02Investigate
  3. 03Contain
  4. 04Rebuild
  5. 05Monitor
incident.logALERT
  1. [detection]Abnormal behaviour in the checkout flow.
  2. [investigation]Card skimmer: data exfiltrated over WebRTC, CSP nonce stolen. The CSP did not stop it.
  3. [investigation]A variant hidden in a Polygon smart contract, with a fake “ClickFix” captcha.
  4. [investigation]5 PHP backdoors, plus a reverse shell disguised as a system process and relaunched by cron.
  5. [cause]SFTP credentials in the web root, one password reused across 5 services.
  6. [contain]Processes killed, attacker servers blocked, evidence preserved and hashed.
  7. [audit]360 SSH logins audited, 1,204 back-office sessions purged.
  8. [decision]Rebuild on fresh hosting instead of cleaning up the compromised server.
  9. [monitor]SHA-256 integrity checks every 15 minutes on about 43,500 files, with email alerts.
  10. [2nd attack]3 webshells caught: 278 files quarantined, no data exfiltrated.
  11. [status]Prod healthy. Monitoring active.
Expertise

What I own

Six areas I work in every day, backed by evidence from real client projects.

Security

Incident response

Investigate, contain, rebuild, then monitor so it does not happen again.

  • 2 intrusions handled end to end, the second one stopped by my own detection
  • 17 audit findings on a site taking payments, 5 critical ones fixed
  • Hacked WordPress fleets cleaned up, hidden persistence found on a second pass
CSPCloudflare WAFiptablesPCI DSS
Performance

Fast, measured

I find the real cause before touching the code, then measure the gain.

  • ERP API from 13.3 s to 0.37 s, about 8,600 SQL queries avoided
  • Store server response from 0.81 s to 0.39 s
  • Fonts from 490 KB to 50 KB, video from 42 MB to 10.8 MB
DoctrineSmartyWP RocketPageSpeed
Development

Custom builds

In-house code when a paid or abandoned plugin no longer cuts it.

  • 15+ in-house PrestaShop modules, including a delivery and click-and-collect checkout
  • WordPress themes delivered from mockup to launch
  • Twig theme migrated to native PHP: 24 controllers in 2 days, zero errors
PHP 8PrestaShopWordPressACF
E-commerce & data

Zero loss

Migrations, integrations and business data that have to stay right.

  • Store upgrades and hosting moves with zero data loss
  • Stripe, Meta Conversions and logistics integrations, with stuck orders recovered
  • Took over a Symfony ERP abandoned by its previous vendor
SymfonyEasyAdminStripeWooCommerce
Infra & ops

Prod under control

Hosting, DNS, email and an in-house tool watching the whole fleet.

  • Monitoring tool: 44 sites, Slack alerts, browser-side encrypted vault
  • Migrations across OVH, Infomaniak and Debian VPS, MySQL to MariaDB
  • Atomic deployments with tested rollback, SPF, DKIM and DMARC
LinuxNginxCloudflareBrevo
AI & team

AI agents on a leash

AI speeds up the work, guardrails keep prod intact.

  • Up to 5 Claude Code agents in parallel on one production, with a coordination rule
  • Least-privilege permissions, writes validated in a dry run first
  • I manage an apprentice who handled a security incident on their own
Claude CodeMCPPlaywright
Career

Eight years of web

Mar 2024 → today · permanent

SPKTR web agency, Toulouse

Full-stack developer · Tech lead

Tech lead of the agency: I own the technical side of every project (stack, hosting, estimates, planning), manage an apprentice and run production for dozens of client sites.

Sep 2023 → Mar 2024 · fully remote

Freelance

Full-stack developer

React front ends and Strapi APIs in TypeScript for a range of projects, design integration, front and back-end optimisation.

Feb 2021 → Sep 2023 · work-study

Aspodelk

Web developer · Technical manager

Built, hosted, maintained and optimised for search around a hundred client sites. Rolled out the company's ERP.

2018 → 2023

Ynov Campus Toulouse

Bachelor's in Development, then a Master's degree as Web Development Expert

5-year degree: software architecture, full-stack and mobile web, testing, IT project management.

Side projects

Evenings too

MCP · Supabase · Claude

Vigie

My always-on personal agent. MCP server hosted on Supabase, 4 scheduled routines with scoped tools, read-only Gmail, Calendar and Notion. Shipped in 4 days, with no server to pay for.

Expo · React Native · TypeScript

Atlas

Daily-tracking mobile app: barcode-scan nutrition, workouts, tasks. Claude API called server-side, mini-games balanced by a bot that simulates matches.

PHP 8SymfonyLaravelTypeScriptReactReact NativeVue.jsNode.jsStrapiWordPressPrestaShopSupabase
LinuxNginxApacheDockerCloudflareiptablesMariaDBGitPlaywrightStripeClaude CodeMCP
Contact

Let's talk remote.

I'm looking for a full-remote permanent role from France: lead full-stack developer, product engineer, solutions engineer or developer advocate.

romaincostes81@gmail.com
View my LinkedIn ↗
© 2026 Romain Costes · Lisle-sur-Tarn, FranceHand-coded · animated with GSAP