We are CYBER ONIONS, a small web development and information security studio. We work in cybersecurity and ethical hacking, with Linux servers and VPS, with WSL2 environments, and with technical training. We also develop in PHP and JavaScript, with web applications and databases, using only open source technology.
The sentence that describes our method is simple: we work on defence with the same curiosity we bring to attacks. An analyst who has never tried to break into a system does not know where to look, and an administrator who has never lost a server does not know what to protect.
What we do
Cybersecurity. Attack surface analysis, server hardening, access management, backup and recovery, monitoring. We work on both new systems and ones that have been running for years and nobody has looked at since.
Ethical hacking. Authorised penetration tests, with written rules and a perimeter defined before we start. The goal is not to "get in": it is to find the conditions someone else could exploit, and to work out whether someone is already exploiting them.
Web development. PHP, JavaScript and web applications, from backend to frontend, with attention to what goes into production: performance, accessibility, error handling. We prefer code you can still read in six months to code that impresses today.
Database. MySQL, SQLite and relational modelling in general. Schema design, queries that do not run full table scans, indexes chosen on purpose rather than by habit, backup and verified recovery.
Linux servers and VPS. Installation, configuration and maintenance of servers, post-installation hardening, automated backups, certificate management, updates without downtime windows. We choose the simplest tool that works: a service you do not have to administer should not be administered.
WSL2. Development and testing on Windows with Linux distributions, virtual machine management, network and permission problems. A comfortable, repeatable environment changes the way you test, and the way you test changes the software you write.
Technical training. For people who need to understand, not only for people who need to remember: the basics of security, Linux, networking, and the responsible use of tools. Training aimed at people who actually work on systems.
Open source, by choice
We work with open source tools and open technologies. It is not an aesthetic preference, it is a technical choice with three concrete consequences: we can read the code of what we use, we do not have to license anything to use it, and nobody can change the rules under our feet.
In practice that means PHP, Linux, MySQL, SQLite, command line tools and freely licensed libraries. No proprietary, closed stack, no dependency on platforms that impose their own ecosystem and their own subscription fees.
The practical reason is that a closed infrastructure in ten years is a problem, even if it works well today. An open infrastructure in ten years is a set of tools we know and can still use, even if they have changed. The initial cost is a few extra hours of configuration; the saving is not having to start over from scratch.
How we work
We believe in three things that cost nothing and are worth a lot.
Understand first, then advise. An analysis that starts from "we recommend you put this product in" is not an analysis. An analysis starts from "what do you do, with what data, and who has access to it".
No black boxes. If we propose a tool or a service, we can say how it works and what we cannot see. Solutions we do not understand are weak: the day they go wrong, we do not even know where to start looking.
The work must stay understandable. An administration that only the administrator understands is an administration that stops working in six months. We document as we go, not afterwards.
We keep well away from commercial .net products and proprietary Windows ecosystems, mainly for strategic reasons:
- Main reason: We avoid commercial licences and hidden costs to preserve complete development autonomy and reduce fixed costs.
- Flexibility and control: The open-source and Linux ecosystem offers full transparency over the code, no lock-in and granular control of the server infrastructure.
- Autonomy and licence costs: We avoid restrictive licensing models and recurring fees that tie development hands, eliminating unnecessary fixed costs for the infrastructure.
- Total control of the infrastructure: The Linux environment and the open-source stack guarantee native transparency, maximum stability on servers and complete absence of vendor lock-in.
- Flexibility of the stack: We prefer a completely customisable software assembly line, where every single component (from database management to the web server) is auditable and tailored without depending on closed ecosystems.
The people
There are two of us — plus one — with different and complementary roles.
IAIA (Alessandra) — Web Content Manager, SMM, SEO Specialist. Behind the content, the project structure and the part you see from this side.
MANUEL — Full Stack Web Developer, SysAdmin. From code to servers: development, system administration, and the technical work behind the pages you are reading.
THE OTHERS — External collaborators, consultants and trainers.
How we speak
This site is written for people who work: no alarmism, no sophistry. If an article says a control solves a problem, we also say what it does not solve. If a practice is disputed, we present it as disputed. Security is worth as much as the clarity with which it is discussed.
Technical content has its sources at the bottom and the figures quoted are verifiable. If we get something wrong, write to us: we correct errors and update the article.
What we like
Films and horror series, and a passionate love for grindcore.