Przemysław Zalewski

For companies where people build their own tools

Your people built apps with AI. Put them behind your company login.

Sales has a quote calculator, the warehouse a stock report, HR an onboarding checklist, each built by someone with Claude or Lovable over a weekend. To use them across the company they need your company login and one place to live. That is a day of work per app, not a project.

See price and start date → Book a free 30‑min call

Hourly at $36⁠–⁠54/h excl. VAT. The first app usually takes about a day. Details in the configurator →

Przemysław Zalewski

Sound familiar?

Company login problems I fix in 2026

Have employees built AI apps that IT does not know about?

Verizon’s 2026 breach report, published in May 2026, found that 45% of employees now regularly use AI on company devices, up from 15% a year earlier, and 67% of those users reach AI tools through personal, non-company accounts (Verizon DBIR 2026).

I put each app behind your Entra ID or Google Workspace login and gather them in one place, so IT can see what exists and who can open it, without rewriting the apps.

Our internal tool still runs on one shared password

Verizon’s 2026 breach report, published in May 2026, still finds credential abuse behind 13% of breaches with a known way in, one of the top three entry points next to vulnerability exploitation (31%) and phishing (16%) (Verizon DBIR 2026).

I replace the shared password with your company accounts, so access ends when an account is disabled and every sign‑in belongs to a named person. In January 2025 I removed credentials sitting in a pinned team message and proposed one company sign‑in for internal tools instead of shared logins.

Sound like you? Book a free 30‑min call →

Is our Lovable app’s code visible to people outside the company?

Lovable says that from 3 February to 20 April 2026 a regression let any Lovable user with the link open the chat history and source code of public projects (Lovable).

I move the app into your company’s repository and hosting, behind company login, and help you rotate any keys that ever sat in a prompt or in the code.

Do former contractors still have access to our internal apps?

Verizon’s 2026 breach report, published on 19 May 2026, found that breaches involving a third party rose from 30% to 48% in a year (Verizon).

I make contractors sign in with accounts your company controls, so ending a contract means disabling one account instead of hunting for passwords in five apps.

Facing one of these? Book a free 30‑min call →

Scope

What you get

Company login

Sign‑in with your existing Microsoft Entra ID or Google Workspace accounts. When someone leaves, their access goes with their account.

One place for the apps

One address where the company’s internal apps live, with a list people can find.

One way to deploy

Every app deploys the same way, so the next person can update it without asking the author.

A short guide

How to add the next app, written for the people who build them.

Process

How it works

  1. 30-minute call

    You show me the apps and where your company accounts live.

  2. One app first

    I put the most used app behind company login and into its new home, usually in a day.

  3. The rest

    The other apps follow the same path, one by one.

  4. After

    Optional monthly care for the platform and new apps.

What this is not

  • A security audit or a code review.
  • A rewrite of the apps.
  • A new identity system: it uses the accounts you already have.

Track record

Proof

I run a family of internal and public apps on Cloudflare with shared deploys and analytics, and I set up coding agents for teams under shared rules.

Four side projects on Cloudflare Workers under one domain

The problem
Ideas die when deploying them costs a weekend. I wanted a path from idea to a URL in an evening.
What I did
Korpo Tłumacz, Wyrocznia, Migawki and Przemo (Agent): each a Worker with static assets, Workers AI with per‑IP and global rate limits, a cost cap in a Durable Object, R2 for generated images, a first-party PostHog proxy and a CSP without inline scripts.
Result
Live at ciunkos.com/korpo-tlumacz, /wyrocznia, /migawki and /przemo. This page runs on the same pattern.

Workers AI Durable Objects R2 Open ↗

See also: Cloudflare · AI & agents

Back-office task management: team lead of four, no product manager

The problem
A back-office tool needed new features, a UI refresh and a faster pipeline, with no product manager in sight.
What I did
I led four engineers and kept coding. Trunk-based development with CI/CD, live updates over server-sent events, a stopped parallel initiative that analysis showed would not pay off, priorities set directly with department managers. A survey of the 100+ operators who used the tool rated the changes a clear improvement.
Result
“Measurable changes in some key metrics” and “a true bias for action”, in the public LinkedIn recommendation of my manager on that project, now a CTO.

team of 4 manager recommendation

See also: Full‑stack & custom software

An AI coding agent as a team member, under enforced rules

The problem
Coding agents write code faster than a team can review it. A team of four wanted the speed without a slop swamp on main.
What I did
I authored the rule set shared by Claude Code and Codex: mechanical checks over written rules, lint and test gates for security, API surface and CSP, agents working on main with hooks, every PR reviewed by a human, AI‑assisted content disclosed as such.
Result
In 2026 about two thirds of merged pull requests across two products were built with coding agents, and nearly all went through my review or merge. I merged 260+ PRs of my own and reviewed 300+ of other engineers’. My commits across those two products went from under 1,000 in 2025 to 7,500+ by October 2026.

~2/3 PRs with agents 300+ reviews 7,500+ commits in 2026

See also: AI & agents · Full‑stack & custom software

Offer: AI engineer for your team (Node.js, LLM agents)

Want the number before the call?

Hourly at $36⁠–⁠54/h excl. VAT. The first app usually takes about a day.

See price and start date → Book a free 30‑min call

Good to know

Company login facts that break internal apps

Entra client secrets expire within 24 months

An Entra ID client secret lasts at most 24 months, Microsoft recommends under 12, and the value is shown only once. The app breaks on the expiry date unless someone rotates it (Microsoft Learn).

Without assignment, everyone can sign in

By default an Entra app does not require user assignment, and unassigned users can still sign in; they just do not see it in My Apps (Microsoft Learn).

Group-based access needs P1 or P2

Assigning app access by group requires Entra ID P1 or P2, and nested groups do not count (Microsoft Learn).

Single tenant still lets guests in

“Accounts in this directory only” includes guest accounts in your directory, so guest access needs its own decision (Microsoft Learn).

Google Testing mode logs users out weekly

An External Google OAuth app left in Testing gets refresh tokens that expire after 7 days. Internal apps need no verification but work only inside your organization (Google OAuth, Google Cloud Help).

SAML certificates warn only the admin who added the app

Entra signing certificates last 3 years, and expiry emails go 60, 30 and 7 days ahead, by default to the admin who added the app (Microsoft Learn).

FAQ

Questions

Can a Lovable or Claude-built app use Microsoft Entra ID login?
Yes. Either the app signs users in with your company accounts itself, or it sits behind a login gateway that does it before the app loads.
Do we need to change our Microsoft or Google setup?
Usually only an app registration that your administrator approves from the exact steps I prepare. You keep the admin rights: I do not need a global administrator account.
How long does it take?
About a day for the first app, less for each next one.
Where do the apps run?
Where you prefer: your cloud account or a simple hosting I set up on your company’s account.
What does it cost?
Hourly, 36 to 54 USD, and the first app usually takes about a day. The configurator shows the price and start date; pricing has the rates.
Why did our internal app’s Microsoft login stop working?
Often an expired client secret: Entra caps them at 24 months and shows the value once, so the app needs a rotation date in the calendar (Microsoft Learn).
Does a Google Workspace login app need Google verification?
Not if it is set to Internal and used only inside your organization (Google Cloud Help). Apps that ask for restricted scopes need an annual security assessment (Google Cloud Help).
Have employees built AI apps that IT does not know about?
Verizon’s 2026 breach report, published in May 2026, found that 45% of employees now regularly use AI on company devices, up from 15% a year earlier, and 67% of those users reach AI tools through personal, non-company accounts (Verizon DBIR 2026). I put each app behind your Entra ID or Google Workspace login and gather them in one place, so IT can see what exists and who can open it, without rewriting the apps.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work can start now · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.