Marvin OttoSoftware & Security
Available for projects
Leipzig --:--Back
Interactive · scale 1 : 1Design · Engineering · SecurityTurn the knob · drag the deviceTap the knob

I design and build websites, apps, software, brandsand test their security before they go live.

Scroll
Approach

I'm a software engineer and penetration tester based in Leipzig. I work with companies and founders on anything from a landing page to custom software. You see the work take shape week by week, and nothing goes live before you've approved it.

Inside

Anatomy

Every product has four layers: design, interaction, engineering and security. Scroll on, and the device comes apart one layer at a time.

Exploded view1 : 1

I design the interface and the brand.

You see every screen as a design before I write any code. I build it myself afterwards, so the finished site looks like what you approved. If you need a logo or brand colours, I make those too.

Interface & brand

I build it for the browser and the phone.

Websites and web apps in React, Next.js or Astro, mobile apps in Flutter or React Native. Buttons and forms respond right away, and the loading, empty and error states are designed too.

Web & mobile apps

I write the software behind it.

APIs, databases, logins and the connections to tools you already use, mostly in TypeScript and Node.js with PostgreSQL. It's tested and documented, so another developer can take it over.

Software

I test it for security holes before it goes live.

Penetration testing is my second job. Before launch I go through logins, permissions and every API endpoint by hand, with the same checklists I use for clients (OWASP Top 10, ASVS). What I find, I fix and test again.

Penetration testing
Layer01 / 04

Craft

Design & code

Eight small studies of how I work: type, animation, responsive layout, design systems, code, accessibility, performance and security. Each one runs live in your browser.

01 · Typography

A type scale for every project.

Four sizes with fixed line heights, from display to label. Letter pairs like A and v are kerned by hand where the font's defaults leave a gap.

02 · Motion

Movement that slows to a stop.

Things start fast and settle slowly (expo out), the way physical objects come to rest. The study plays the same 12 frames with and without easing.

03 · Responsive

One layout from 390 to 1440 px.

The same content reflows from several columns to one. Nothing is hidden on a phone and nothing is simply scaled down.

04 · Systems

Tokens first, screens second.

Colours, radii and spacing are defined once as tokens. Components are built from them, so one change updates every screen.

05 · Code

Six lines, one button.

Plain, readable CSS, with the colours taken from variables. The button underneath is exactly what these six lines produce.

06 · Accessibility

Every field reachable with Tab.

Each field has a label that a screen reader announces, and the focus is always visible. Contrast is measured against WCAG AA.

07 · Performance

Load time measured from the first build.

I measure the Core Web Vitals (LCP, CLS, INP) from the first build on. Images get fixed dimensions, fonts are preloaded and scripts load only when they're needed.

08 · Security

Security headers before launch.

HTTPS with HSTS, a Content Security Policy, secure cookies and rate limiting are in place before launch. Dependencies are audited with every release.

Study01 / 08

Work

Selected projects

Five products I designed and built myself: a crypto wallet, a music app, an inventory tool, a focus timer and a property platform.

  1. 01Purse
  2. 02Clario
  3. 03StockMate
  4. 04Focus
  5. 05Qasa
Web application2024

Crypto wallet

A crypto wallet that doesn't stress you out.

  • Flutter
  • Dart
  • web3dart
Case study

Music platform

Find new music without digging through clutter.

  • React Native
  • Node.js
  • Audio analysis
Case study

Inventory management

Inventory without the spreadsheet chaos.

  • React
  • TypeScript
  • Zustand
Case study

Deep-work app

An app that keeps distractions away while you work.

  • React Native
  • Node.js
  • Local-first
Case study

Real estate

Find, rent and list property in one place.

  • Next.js
  • React
  • Node.js
Case study
Project01 / 05

Pentesting

Security

I test web apps, APIs and cloud setups for security holes, by hand. We agree the scope in writing before I start. You get every finding with its risk, the steps to reproduce it and a fix, and the retest is free.

01 Scope02 Map03 Chain04 Fix

It starts with a signature.

We put in writing what I test, when I test it and who I call if something comes up. I don't touch anything before you've signed.

First I look at everything.

Web app, API, logins, cloud and data. I check how the parts trust each other, because that's where most weak spots are.

Small issues, one real risk.

A forgotten staging server, a default login, an ID the API never checks. Each one looks harmless. Put together, they lead straight to your customers' data.

Every finding gets a fix.

I rate each finding by risk and write down how to reproduce it and how to fix it. Once your team has fixed it, I test again for free. The report is one you can hand to clients and auditors.

Request a test

Services

Scope & prices

Fixed prices for the things I get asked for most. Need something else? Call me first, that part is free.

Hand-coded

Designed for you and coded by hand, without templates or page builders. Maintenance after launch is included.

For freelancers and small businesses who need one good page that brings in enquiries.

  • 1–3 custom-coded pages
  • Responsive, with considered motion
  • Contact form integration
  • SEO-ready structure
  • Hosting-ready delivery
  • 1 month of maintenance included

A full website for a growing company, built so you can add to it later.

  • 5–8 custom-designed pages
  • CMS / admin panel
  • Contact form + newsletter
  • Comprehensive SEO
  • Performance-first architecture
  • 3 months of maintenance included

A web application built for you, with a database, an API and an admin area.

  • Custom application architecture
  • Database & API integration
  • Admin panel & authentication
  • React / Next.js, Node
  • Scalable, maintainable codebase
  • 6 months of maintenance included

All prices net, excl. VAT. Every project starts with a free first call and a written estimate.

Process

How we work together

Four steps from the first call to launch. You sign off each one before I start the next.

Fig. 1 — The first callFig. 2 — The planFig. 3 — The buildFig. 4 — Live01 / 04
  1. 01 · Discovery

    First, I listen.

    We talk about who your users are, what you want to achieve and what you can spend. Then you get a written brief and a fixed price. Nothing else happens before that.

    Result
    Brief & fixed quote
    Time
    1–2 weeks
  2. 02 · Strategy

    A plan you can see.

    I draw up the sitemap, the user flows and the architecture, and we go through them together. Changing things on paper costs nothing, so this is where we decide.

    Result
    Sitemap & architecture
    Time
    1–2 weeks
  3. 03 · Build

    Something new every week.

    I work in short sprints. Every week you get a version you can click through, and security checks run with every release.

    Result
    Tested releases
    Time
    By scope
  4. 04 · Launch

    Live, and I stay around.

    I deploy it, document it and hand it over properly. If you want, a care plan keeps it fast, secure and up to date.

    Result
    Launch & care plan
    Time
    Ongoing

About

The person

I'm Marvin. As a kid I took things apart to find out how they worked. These days I build websites, apps and software for clients all over the world. And because I'm also a penetration tester, I check that they're secure before they go live.

  1. Childhood

    Taking things apart

    Wanting to know how things work, and how they break.

  2. Early years

    The first page of code

    View source, change something, watch what happens.

  3. 2011–14

    Developer training

    Where the hobby became a trade.

  4. 2014–22

    Military service

    Eight years. I learned to be precise and to take responsibility.

  5. 2022–25

    B.Sc. Software Development

    The theory behind what I'd been doing for years.

  6. 2025–now

    Independent

    Web, software and security for clients worldwide.

The full story
ContactLeipzig --:-- · Available for projects

Have a projectin mind?

Tell me what you're working on. I read every message and answer it myself.

Start a project