I build &I secure.
I'm Nishan Singh. Through Hack & Hustle Studio I design, build, and secure websites & mobile apps for local businesses — and I'm training as a cybersecurity professional through real labs and reports.
Hack & Hustle Studio
Build it. Ship it. Secure it.
A one-person studio in Surrey, BC building websites, mobile apps, and the security that keeps them standing.
Hack & Hustle is how I work with businesses. You deal directly with the person writing the code — no account managers, no agency markup, no handoffs. I design it, build it, launch it, and stay on afterwards.
Websites & web apps
Fast, mobile-friendly sites that show up on Google and turn visitors into customers — plus the moving parts behind them: online ordering, booking, and payments.
- Next.js business websites
- Online ordering & booking
- Stripe payments
- Local SEO built in
Mobile apps
Cross-platform iOS and Android apps built from one codebase — and shipped to the stores, not left in a demo folder. My own app is live on the App Store.
- React Native / Expo
- iOS & Android from one build
- Supabase backends
- App Store submission
Security & hardening
Most small business sites fail the basics — no HTTPS enforcement, missing headers, cookies exposed, no email spoofing protection. I find those, explain them in plain English, and fix them.
- Free security health check
- HTTPS & TLS hardening
- Security headers & cookies
- SPF / DMARC anti-spoofing
How it works
- 01
Quick chat
You tell me what your business needs. Free, no pressure.
- 02
Clear quote
I send a simple plan and a fair, fixed price before any work starts.
- 03
I build it
You see progress along the way and give feedback.
- 04
Launch & support
Your site or app goes live, and I'm here for updates after.
- You work directly with the developer — no agency markup, no account managers.
- Fixed, upfront pricing before any work starts. No surprises.
- Plain-English communication — no technical jargon.
- Real, working projects behind me: TAKO Vancouver, Tri-Star Immigration Services, Candora Transportation.
- Security isn't an upsell — every site I build ships hardened by default.
- Local to Surrey/Vancouver, quick to reply, and around after launch.
Real sites,
live in the card.
These aren't screenshots — each card streams the actual live website. Hover and click to open the real thing.
TAKO Vancouver
LiveRestaurant · Online ordering
Tri-Star Immigration Services
LiveImmigration consultant
Candora Transportation
LiveTransportation · Logistics
Project Chai
LiveCafé · Indian street food
Kinship Home Care
LiveHome care · Seniors
PayLeaf
In progressProduct · QR payments
And two that live
in your pocket.
My own products, shipped to the App Store — real screenshots from the live listings.
Flyerly
Shopping · iPhone · iOS 16.4+
Your neighbourhood's best deals in one place. Local grocery, cafe and restaurant flyers, sorted by what's nearest — with a ping the moment a shop you follow posts something new.
- Stores sorted by distance
- Follow shops for new-deal alerts
- Happy hour & time-limited deals
- Filter by grocery, meat, bakery, cafe
- Price
- Free
- Version
- 1.4.0
- Updated
- Aug 2026
PayLeaf: QR Payments
Finance · iPhone · iOS 15.1+
QR payments and smart invoices for Canadian small businesses. Customers scan with their phone camera and pay by card — no terminal, no monthly fees.
- Scan-to-pay QR codes
- Branded PDF invoices
- AI invoice drafting
- Stripe payouts to your bank
- Price
- Free
- Version
- 2.3
- Updated
- Jul 2026
Check your site's
security in 10 seconds.
A passive best-practices scan — not a penetration test. It reads what your site tells every visitor anyway: response headers, the TLS certificate, cookie flags, and public DNS records. Every finding is mapped to published guidance from OWASP, MDN, NIST or an IETF RFC, with a link so you can check the reasoning yourself.
// roughly the same passive checks as securityheaders.com and Mozilla Observatory, with the "why" attached
What it does
- · One HTTPS GET of the page you enter, following redirects
- · One plain-HTTP GET to see whether visitors get upgraded
- · TLS handshakes to read the certificate and protocol version
- · Public DNS lookups: SPF, DMARC, CAA, MTA-STS, MX
- · One request for /.well-known/security.txt
What it does not do
- · No login attempts, password guessing, or form submission
- · No port scanning — only ports 80, 443, 8080 and 8443 are reachable
- · No payload injection, fuzzing, or path enumeration
- · No crawling — it looks at one page, not your whole site
- · Nothing that touches your database or application logic
Passive best-practices check, not a penetration test. Only scan sites you own or are authorized to test. See the Terms of Use.
Labs, scans
& reports.
Based in Surrey, BC. I turn small businesses' ideas into shipped products — and I'm building the skills to keep them safe.