What does Kiril Urbonas do?

Kiril Urbonas is a freelance full-stack and AI engineer. I design, build, deploy, and run websites, web apps, e-commerce stores, SaaS platforms, and AI automations end to end for founders and small teams. I also build and operate my own live products — from a 400+ article engineering publication (DevOpsNess) to a real-time AppSec intelligence platform (ZeroDayAttack) and a native iOS app (MyHomeStock) — so clients can see the standard before they hire.

What technologies and stack does Kiril Urbonas use?

My core stack is Next.js, React, and TypeScript on the front end; Node.js, PostgreSQL, and Prisma on the back end; and OpenAI and Claude APIs, RAG, and AI agents for automation. I deploy on Vercel and AWS with Docker and CI/CD. I build on modern frameworks rather than WordPress page builders, which is why the sites I ship typically load in under 1.5 seconds and score 90+ on Lighthouse.

Which service or package is right for my project?

A quick guide: choose a Landing Page (from €500) for one focused page to capture leads or validate an idea; a Business Website (from €1,500) for a multi-page site that builds credibility and ranks in search; an E-Commerce or Web App build (from €3,000) if you sell online or need custom functionality, dashboards, and integrations; and an AI / SaaS Platform (from €5,000) for products with accounts, billing, multi-tenant infrastructure, or AI agents. If you're unsure, send the contact form and I'll recommend the smallest scope that solves your problem.

Why hire you instead of a cheaper freelancer or an agency?

Cheaper freelancers often disappear after handoff or ship a generic template; agencies layer on account managers and developers, so costs climb, communication slows, and you rarely speak to whoever is actually building your product. I do the strategy, design, development, and deployment myself - one point of contact, full accountability, no handoff gaps. You can judge the standard from the products I build and run end to end - DevOpsNess, MyHomeStock, QRify and more, all live.

What is your process for new projects?

Step 1: You fill in the contact form or we jump on a 15-minute call. Step 2: I send a custom proposal with scope, timeline, and fixed price within 48 hours. Step 3: Before writing a line of production code, you get a full design mockup to review and approve. Step 4: I build, you get weekly progress updates, and we launch. Post-launch, I'm available for a support window to fix anything that comes up.

What is your typical pricing range?

Every quote is fixed-price with no surprises. As a guide: landing pages and lead capture sites start around €500–€1,500; e-commerce rebuilds and custom web apps range from €2,000–€8,000+; AI integrations and SaaS platforms are quoted per project scope. The contact form takes 2 minutes - I'll send a custom proposal with a precise number, no obligation.

How long does a typical project take?

Landing pages: 1–2 weeks. E-commerce stores and marketing sites: 3–6 weeks. Custom web apps and SaaS platforms: 6–12 weeks. AI integrations: 3–6 weeks depending on complexity. I'll give you a specific delivery date in the proposal - not a range. If something comes up that affects the timeline, you hear about it before it's a problem.

How quickly can you start?

Usually within 1–2 weeks of proposal sign-off. I keep my project load intentionally small so I can give each client real focus - I'm not running 10 projects at once. If you have a hard deadline, mention it in the contact form and I'll tell you upfront whether it's achievable.

What if I'm not happy with the result?

That's unlikely by design. Every project starts with a full mockup - design, layout, and copy - that you review and approve before any production code is written. You request changes, I refine it, and the build only begins once you sign off. The proposal also defines clear revision rounds, so expectations are set from day one.

Do you work with clients outside your time zone?

Yes - the majority of my clients are in Western Europe and the US. I work async by default (detailed written updates, Loom videos for walkthroughs) and schedule calls to overlap with your working hours when needed. Time zones have never been a problem.

What do you need from me to get started?

An idea of what you want to achieve, your approximate timeline, and any existing brand assets or content you have. You don't need a detailed spec - that's what the discovery process is for. Fill in the form, describe the problem in plain English, and I'll take it from there.

Do you offer support after launch?

Yes. Every project includes a post-launch support window (typically 2–4 weeks) where I fix any issues at no extra cost. For ongoing support - new features, content updates, performance monitoring - monthly retainers are available. I've had clients on retainer for 2+ years.

Home/Work/ZeroDayAttack

All projects

Live Security Platform

ZeroDayAttack - AppSec Intelligence Aggregator

A self-initiated security product I built and run - live at zerodayattack.net. The single real-time intelligence source an AppSec engineer checks: CVEs, CISA KEV, EPSS, exploit signals, threat actors, IOCs, vendor/PSIRT advisories and research - unified, normalized, deduplicated and pushed live from ~85 feeds. Plus an authenticated workspace that turns intel into action: asset profiles drive a personalized patch queue, with watchlists/alerts, triage, remediation SLAs and Jira/GitHub/SIEM hand-off.

Ongoing - live and updated continuously · 2026Kiril Urbonas

Scope: Solo build: ~85-feed ingestion pipeline, normalization + trust ordering, realtime ISR site, authenticated remediation workspace, REST/STIX/TAXII federation and CLI.

Next.js 15TypeScriptTailwind CSSSupabasePostgresRealtimeISRVercel

Result

~85 sourcesCVE, KEV, EPSS, advisories, IOCs, actors, research - unified

Result

Real-timeSupabase realtime → live updates on CDN-cached pages

Result

WorkspaceAsset profiles → personalized patch queue, SLAs, triage

Result

API · STIX · TAXIIREST /api/v1, OpenAPI, STIX 2.1, TAXII 2.1, CLI

Live Demo

Click around - it's fully interactive

Live at zerodayattack.net

A self-initiated security product I built and run - live at zerodayattack.net. The single real-time intelligence source an AppSec engineer checks: CVEs, CISA KEV, EPSS, exploit signals, threat actors, IOCs, vendor/PSIRT advisories and security research - unified, normalized, deduplicated, searchable and pushed live from ~85 feeds. Plus an authenticated workspace that turns intel into action: asset profiles drive a personalized patch queue, with watchlists/alerts, triage, remediation SLAs and Jira/GitHub/SIEM hand-off.

app.local

ZeroDayAttack - AppSec Intelligence Aggregator — screenshot 1

Open zerodayattack.net

Open ZeroDayAttack

The Challenge

AppSec teams drown in fragmented intelligence: NVD in one place, CISA KEV in another, then EPSS, vendor PSIRTs, exploit PoCs, IOC feeds, MITRE ATT&CK and research RSS - each a different schema, cadence and trust level, and none prioritized for your specific stack. Turning that firehose into "what do I patch first, and is it actually being exploited" is manual, slow, and stale by the time it is finished. The opening was one normalized, real-time source of truth that reads as a public briefing and also drives a private remediation workflow - without a wall of false-urgency noise.

The Solution

Built on Next.js 15 (App Router), TypeScript, Tailwind and Supabase (Postgres + Realtime + RLS) on Vercel. ~85 feeds are ingested on tiered Vercel crons (5-min / 30-min / daily / EPSS) into an append-only event log and merged into canonical records through a source trust order (NVD > vulnrichment > ZDI > GHSA > OSV > … > KEV > EPSS), with every outbound fetch behind an SSRF host allowlist. High-traffic public pages are ISR - served from the CDN yet still updating live, because Supabase realtime changes are merged into the TanStack Query cache; a per-request CSP-nonce "strict" mode for the workspace and a constant "content" CSP for cached pages keep both fast and locked down (anon RLS reads only; service-role key server-only). Public surfaces: a threat briefing, CVE feed, emerging-exploitation signals, CISA KEV zero-days, threat actors, IOCs, vendors, news, CWE/CVE detail, compare, search and source-health/status. The authenticated workspace turns intel into action: asset profiles personalize the patch queue, plus watchlists and alert channels, a triage bench, investigations, a query builder, remediation metrics (MTTR / SLA / burn-down) and integrations (Jira / Linear / ServiceNow / GitHub / SIEM). Federation-ready: a versioned REST API (`/api/v1`), OpenAPI docs, STIX 2.1 bundles, a TAXII 2.1 server and a CLI.

Client

Kiril Urbonas

“I built ZeroDayAttack because triaging vulnerabilities meant juggling NVD, KEV, EPSS, vendor advisories and exploit feeds by hand. It unifies ~85 sources into one real-time, normalized briefing, then turns it into a personalized patch queue with SLAs and Jira/GitHub hand-off. The realtime-on-ISR architecture and the SSRF/RLS/CSP hardening are exactly the standard I bring to client work.”

Kiril Urbonas

Creator & Engineer, ZeroDayAttack

zerodayattack.net

Key Results

~85 sources

CVE, KEV, EPSS, advisories, IOCs, actors, research - unified

Real-time

Supabase realtime → live updates on CDN-cached pages

Workspace

Asset profiles → personalized patch queue, SLAs, triage

API · STIX · TAXII

REST /api/v1, OpenAPI, STIX 2.1, TAXII 2.1, CLI

Timeline

Ongoing - live and updated continuously · 2026

Completed 2026

Scope: Solo build: ~85-feed ingestion pipeline, normalization + trust ordering, realtime ISR site, authenticated remediation workspace, REST/STIX/TAXII federation and CLI.

More case studies

PDFer

Live Product

Rimon

Custom Platform · For Sale

Want results like these for your business?

I'll map out a clear plan, timeline, and realistic results for your project - no obligation.

Start your project See more work

ZeroDayAttack - AppSec Intelligence Aggregator

Ongoing - live and updated continuously · 2026Kiril Urbonas

Scope: Solo build: ~85-feed ingestion pipeline, normalization + trust ordering, realtime ISR site, authenticated remediation workspace, REST/STIX/TAXII federation and CLI.

Next.js 15TypeScriptTailwind CSSSupabasePostgresRealtimeISRVercel

Key Results

~85 sources

CVE, KEV, EPSS, advisories, IOCs, actors, research - unified

Real-time

Supabase realtime → live updates on CDN-cached pages

Workspace

Asset profiles → personalized patch queue, SLAs, triage

API · STIX · TAXII

REST /api/v1, OpenAPI, STIX 2.1, TAXII 2.1, CLI

Timeline

Ongoing - live and updated continuously · 2026

Completed 2026

Scope: Solo build: ~85-feed ingestion pipeline, normalization + trust ordering, realtime ISR site, authenticated remediation workspace, REST/STIX/TAXII federation and CLI.