# DField Solutions

> A software studio in Hungary building AI systems, security work, blockchain and full-stack
> products. Founded and run by Dezső Mező. Works in English, Hungarian and German, remote
> across the EU.

The site presents itself as an illustrated workshop you walk through; every section below is
a normal page with the same content in text.

Any of the pages below is also served as clean Markdown at its own URL with `.md` on the end
— for example https://dfieldsolutions.hu/en/services/cybersecurity.md — with no navigation, no canvas and no hydration payload around it.
Prefer those.

Section names in the URLs are translated per language — English /en/contact, Hungarian
/hu/kapcsolat, German /de/kontakt. The links below are already in each language's own
form; the English word under another locale's prefix redirects to the translated one.

## What we do, how, and why it works
### What we do: We build the software your business runs on.
- AI automation that runs inside your business
- Purple Team security: we attack, then harden
- Web, mobile, blockchain, generative AI
### How we work: A 30-minute call, a visual plan, then steady building — you own everything.
- Free 30-minute call, no deck
- A concept and build plan before we start
- You own the source, the accounts, everything
### Why us: Proof you can check, not claims.
- 23 case studies · 12 countries · 5.0 from named clients
- One engineer, four disciplines, no hand-off
- Six products of our own, credentials you can verify

## Services
- [AI automation](https://dfieldsolutions.hu/en/services/ai-automation): The repetitive half of your week, handed to software that does not get bored. Inbox triage, follow-ups, reporting, data entry between tools that were never meant to talk.
- [Cybersecurity](https://dfieldsolutions.hu/en/services/cybersecurity): Purple Team: the same person writes the exploit and closes the hole. Most agencies only harden, which means hardening against a threat nobody tested.
- [Blockchain](https://dfieldsolutions.hu/en/services/blockchain): Solidity on Ethereum, Polygon, Base and Arbitrum. Anchor programs on Solana. Written with tests first, because a redeploy is not a hotfix once value is on the line.
- [Full-stack](https://dfieldsolutions.hu/en/services/full-stack): If you can describe it, we can build it. React and Next.js on the front, Python or Node behind, Postgres underneath, shipped to somewhere you can afford to run.
- [Generative AI](https://dfieldsolutions.hu/en/services/generative-ai): Stable Diffusion and ComfyUI wired into the place where your content actually gets made, with a model fine-tuned so everything comes out looking like you.
- [Web performance](https://dfieldsolutions.hu/en/services/web-performance): A rebuild that loads on a phone on mobile data, in the country your customers are actually in. Core Web Vitals are the measurement, revenue is the point.

## Products built and run by the studio
- [SimulSpeak](https://dfieldsolutions.hu/en/products/simulspeak): Real-time translated calls, in your own voice — https://simulspeak.com
- [JuriSafe AI](https://dfieldsolutions.hu/en/products/jurisafe): Hungarian legal assistant with cited sources, search to finished document — https://jurisafeai.com
- [AutoSzoftver](https://autoszoftver.hu): Car-import arbitrage: auction prices abroad against real Hungarian resale, fees and tax included
- [alkalmimunkaero.hu](https://alkalmimunkaero.hu): Casual work in one click: verified companies, real reviews, Budapest
- [UseAIEasily](https://dfieldsolutions.hu/en/products/useaieasily): Self-hosted AI customer support: chat, email, voice and phone, on your own server — https://useaieasily.com
- [FieldCRM](https://minicrm.dfieldsolutions.hu): A CRM that does not cost a fortune: sales, hiring, projects and support as modules, two-way email, automations — live demo

## Proof (named reviews, countries, verifiable credentials)
- 23 case studies · 21 with reviews under NDA · 12 countries: Austria, Germany, Spain, France, United Kingdom, Hungary, Italy, Malta, Mexico, Netherlands, Portugal, United States · founded 2023
- Michael J Ringer, Founder, Vilya Protection (Spain), 5/5: "From LinkedIn DM to live site. Two tiny tweaks, then shipped." — https://demo.vilyaprotection.com
- Müller Márk, Managing Director, GeekCorner (Hungary), 5/5: "New shop, more orders in the first week." — https://geekcorner.hu
- Joran, Founder · product, Noaber AI (Netherlands), 5/5: "Took an AI from demo to production. Now it serves real customers." — https://noaberai.nl
- Júlio Reyes Castro, Owner · print + design, JairePrint (Mexico), 5/5: "Orders and invoicing now run themselves." — https://www.instagram.com/jaireprint
- Kristóf, Short-form editor, Creator Community (Hungary), 5/5: "Three ready-to-post clips in the time it took to make one." — https://discord.gg/BSpKVNHC92
- Jerzso, Musician, Jerzso Music (Hungary), 5/5: "Live in two weeks. Looks like a label is behind me." — https://www.instagram.com/jerzso_/
- Credential: Harvard · CS50 · Computer Science certificate (2023) — https://certificates.cs50.io/f1dcf14a-e360-417c-97c0-c3f57c425a92.pdf?size=letter
- Credential: Google · Professional badge · verifiable on Credly (2024) — https://www.credly.com/badges/830a7a0c-d257-4772-b63d-96ceb28fd736/public_url
- Credential: EU · EITCA · EITCA/IS · European Information Security certification (2024) — https://www.eitci.org/certificatesupplement?id=EITCA/IS/FXR24004421&t=wlfjm2n7prX1xCHL
- Credential: IBM · Professional badge · verifiable on Credly (2024) — https://www.credly.com/badges/387e1738-6965-4079-9faa-7146eae42110/public_url
- Credential: Ackee Blockchain · School of Solana · Season 8 graduate (2025) — https://github.com/dezso-dfield/school-of-solana-season-8
- Credential: Alchemy University · EVM Chain Certification (2025) — https://shapescan.xyz/token/0xCBE9500Ef4F760d05D70381cCDF0169470b137DE
- Credential: Infosec Institute · Blockchain Security certification (2025) — https://coursera.org/verify/5WGF2VG797NS
- [All of it, with faces and verification links](https://dfieldsolutions.hu/en/about) — https://dfieldsolutions.hu/en/about.md

## Writing
- [Making the workshop with ComfyUI](https://dfieldsolutions.hu/en/lab/workshop-with-comfyui): The room you walked through to get here is one painting, cut into thirteen pieces. Generating the pieces separately was the thing that did not work.
- [Prompt injection in production agents](https://dfieldsolutions.hu/en/lab/prompt-injection-playbook): Prompt injection is not one bug with one fix. It is five attack categories, each with a different defence, which is why teams that add input sanitisation once get a vulnerability report two weeks after launch.
- [AI security self-audit](https://dfieldsolutions.hu/en/lab/ai-security-self-audit): Fifteen questions, about five minutes, and nothing leaves your browser. You get a score, a verdict and the fixes for whichever axes you scored worst on.
- [Core Web Vitals on a real Next.js site](https://dfieldsolutions.hu/en/lab/web-vitals-playbook): LCP, INP and CLS are three numbers with three different fixes. Most slow sites fail on the same four things, and none of them need a rewrite.
- [RAG that cannot quote a wrong price](https://dfieldsolutions.hu/en/lab/rag-grounding): A retrieval pipeline that cites stale prices and invented SKUs is worse than none at all. Grounding is a pipeline problem, not a prompt problem.
- [Solana foot-guns Anchor does not remove](https://dfieldsolutions.hu/en/lab/solana-anchor-footguns): Anchor removes the boilerplate, not the sharp edges. The bugs that lose money are the ones the framework politely lets you write.
- [From WhatsApp chaos to a real order pipeline](https://dfieldsolutions.hu/en/lab/whatsapp-order-pipeline): Orders arriving as chat messages feel fast until the day someone misses one. Turning the chat into a pipeline cost less than one lost order.
- [Structured data an answer engine can use](https://dfieldsolutions.hu/en/lab/structured-data-aeo): Search engines read pages. Answer engines read claims. Structured data is how a page says which is which — and this site is the test subject.
- [Where the checkout loses the sale](https://dfieldsolutions.hu/en/lab/checkout-friction): The sale is lost between 'add to cart' and 'paid' in boring, measurable places. The fixes are usually weeks, not redesigns.
- [A backup you never restore is a story](https://dfieldsolutions.hu/en/lab/backup-restore-drill): Every audit asks the same question and gets the same pause: when did you last restore it? The drill is the backup.
- [An accessibility pass in one afternoon](https://dfieldsolutions.hu/en/lab/accessibility-afternoon): A real a11y pass is an afternoon of tabbing, zooming and one screen reader — not a conformance project. The wins are mechanical and mostly free.
- [Prompts are code: eval them like code](https://dfieldsolutions.hu/en/lab/prompt-evals): A prompt that cannot be regression-tested is a script nobody dares to refactor. Versioned, evaluated, diffed — the same hygiene as any deployed artefact.
- [Why your contact form lands in spam](https://dfieldsolutions.hu/en/lab/email-deliverability-basics): The form works, the mailbox is fine, and enquiries still vanish. Almost always the problem is three DNS records nobody wrote down.
- [The local SEO checklist we run for ourselves](https://dfieldsolutions.hu/en/lab/local-seo-playbook): A studio in Dunakeszi competing for 'web developer Budapest' searches. What actually moves a local ranking, in the order it moves it.
- [What we did for the AI crawlers](https://dfieldsolutions.hu/en/lab/llms-txt-ai-crawlers): Every page on this site has a markdown twin, a JSON-LD graph and a seat in llms.txt. Some of it is proven, some of it is a cheap bet — here is which is which.
- [Enquiry to booked call, without the inbox](https://dfieldsolutions.hu/en/lab/booking-pipeline): A service business losing work in the gap between 'they wrote' and 'we replied'. The fix was a pipeline, not a faster typist.
- [Stripe webhooks that survive retries](https://dfieldsolutions.hu/en/lab/stripe-webhooks-idempotent): Stripe will deliver the same event twice, out of order, at 3am. The handler is correct only if none of that matters.
- [One site, three languages, zero duplicate-content problems](https://dfieldsolutions.hu/en/lab/hreflang-trilingual-site): This site answers in English, Hungarian and German — with localized URLs, symmetric hreflang and content that was written, not machine-translated. The build notes.
- [Your thousand dependencies, audited in an afternoon](https://dfieldsolutions.hu/en/lab/dependency-hygiene): Nobody reads a thousand packages; everybody runs them. The boring controls that keep the supply chain survivable.
- [The public status page replaces the status meeting](https://dfieldsolutions.hu/en/lab/public-status-page): Every project we run ships with a public progress endpoint the client can check anytime. What it shows, and why it kills the 'where are we' call.
- [Move the site, keep the rankings](https://dfieldsolutions.hu/en/lab/migration-without-loss): The redesign that loses 40% of organic traffic is not a design failure — it is a redirect failure. The checklist that prevents it.
- [Monitoring that pages someone, not the dashboard](https://dfieldsolutions.hu/en/lab/monitoring-runbook): A dashboard nobody watches is a screensaver. The setup that actually catches the outage: external probes, one alert path, a written runbook.
- [What custom software actually costs](https://dfieldsolutions.hu/en/lab/custom-software-cost): The honest answer is a range with a driver behind it. Small automations land in the low thousands; a product with payments, roles and a mobile surface is a different order of magnitude. What moves the number is never the page count.
- [Custom software or off the shelf — the honest test](https://dfieldsolutions.hu/en/lab/custom-vs-off-the-shelf): The shelf wins when the process is standard. Custom wins when the process is the advantage. The expensive mistake is buying custom to do something a plugin already does, or bending a business to fit a tool it has outgrown.
- [Self-hosted n8n or Zapier — where the bill actually differs](https://dfieldsolutions.hu/en/lab/n8n-self-hosted-vs-zapier): Zapier charges per task and punishes success: the more the automation works, the more it costs. Self-hosted n8n charges in maintenance instead. The crossover is closer than it looks — and it is about data, not just price.
- [The first ninety days of a retainer, as it actually goes](https://dfieldsolutions.hu/en/lab/first-90-days-retainer): Month one reads the codebase before touching it. Month two clears the queue that built up while nobody owned the system. Month three is where it starts looking like progress instead of maintenance.
- [Why clients get a progress page instead of status emails](https://dfieldsolutions.hu/en/lab/client-portal-vs-email): Status emails answer 'where are we' the day they are written and expire immediately. A live progress page answers it whenever the question is asked — and the question gets asked at 11pm.
- [MCP servers in production, not in the demo](https://dfieldsolutions.hu/en/lab/mcp-servers-production): The Model Context Protocol demos beautifully: plug a server in, the model gets tools. In production the questions are duller — who can call what, with whose credentials, and what happens when the tool answers wrong.
- [The AI-search visibility checklist we run on this site](https://dfieldsolutions.hu/en/lab/ai-search-visibility-checklist): Everything on this list ships on this site right now — the schema graph, the llms.txt files, the markdown twins, the glossary built for quoting. This is the checklist version, so it can be checked.
- [The EU accessibility deadline passed — what still applies](https://dfieldsolutions.hu/en/lab/eaa-accessibility-deadline): Since 28 June 2025, the European Accessibility Act applies to e-commerce, banking, e-books and most consumer digital services in the EU — including a Hungarian shop selling to German customers. WCAG 2.1 AA is the yardstick courts will reach for.
- [What Solana RPC actually costs once the prototype works](https://dfieldsolutions.hu/en/lab/solana-rpc-costs): The free RPC endpoint got you through the demo. Production means rate limits, archival history, websockets that stay up — and a provider bill that scales with calls your code did not need to make.
- [The invoice pipeline that ended the Friday admin block](https://dfieldsolutions.hu/en/lab/invoice-pipeline-automation): A service company spent every Friday afternoon typing invoices from timesheets, chasing PO numbers, and re-sending the ones that bounced. The pipeline that replaced it runs Friday morning, unattended.

## Glossary (146 terms, defined without selling anything)
- [Prompt injection](https://dfieldsolutions.hu/en/glossary/prompt-injection): An attack where text the model reads as data is treated by it as instructions instead.
- [RAG (retrieval-augmented generation)](https://dfieldsolutions.hu/en/glossary/rag): Looking up relevant documents first and putting them in the prompt, so the model answers from your material instead of from memory.
- [Embedding](https://dfieldsolutions.hu/en/glossary/embedding): A list of numbers representing a piece of text, arranged so that texts about similar things end up close together.
- [Vector database](https://dfieldsolutions.hu/en/glossary/vector-database): A database built to find the stored items whose embeddings are closest to a query's, quickly, across millions of rows.
- [Large language model (LLM)](https://dfieldsolutions.hu/en/glossary/llm): A model trained on enormous amounts of text to predict what comes next, which turns out to be enough to write, summarise, translate and reason through many tasks.
- [Context window](https://dfieldsolutions.hu/en/glossary/context-window): The maximum amount of text a model can take into account at once, counting the instructions, the conversation and the answer together.
- [System prompt](https://dfieldsolutions.hu/en/glossary/system-prompt): The standing instructions sent ahead of every conversation, setting what the model is supposed to do and how it should behave.
- [Hallucination](https://dfieldsolutions.hu/en/glossary/hallucination): A confident, fluent, entirely invented answer — a citation, a figure or an API that does not exist.
- [Fine-tuning](https://dfieldsolutions.hu/en/glossary/fine-tuning): Continuing to train an existing model on your own examples, so it adopts a behaviour or a style it did not have.
- [LoRA (low-rank adaptation)](https://dfieldsolutions.hu/en/glossary/lora): A way of fine-tuning that trains a small add-on layer instead of the whole model, producing a file of a few megabytes rather than a few gigabytes.
- [AI agent](https://dfieldsolutions.hu/en/glossary/llm-agent): A language model given tools it can call and a goal to pursue, so it decides the steps rather than following a fixed script.
- [Tool calling](https://dfieldsolutions.hu/en/glossary/tool-calling): The mechanism by which a model asks the surrounding application to run a named function, and gets the result back as text.
- [MCP (Model Context Protocol)](https://dfieldsolutions.hu/en/glossary/mcp): An open protocol for exposing tools and data to a model, so one integration works with any client that speaks it.
- [Evaluation (evals)](https://dfieldsolutions.hu/en/glossary/llm-evaluation): A repeatable test set that measures whether a change to an AI system made it better or worse, rather than just different.
- [Stable Diffusion](https://dfieldsolutions.hu/en/glossary/stable-diffusion): A family of open-weight image models that generate a picture by repeatedly removing noise from a random start, guided by a text description.
- [ComfyUI](https://dfieldsolutions.hu/en/glossary/comfyui): A node-based interface for image generation, where the pipeline is an explicit graph rather than a text box with hidden defaults.
- [Purple team](https://dfieldsolutions.hu/en/glossary/purple-team): Running the attack and the defence as one exercise, so every fix is verified against the technique that found the hole.
- [Red team](https://dfieldsolutions.hu/en/glossary/red-team): The offensive side: people whose job is to get in, using whatever an actual attacker would use.
- [Blue team](https://dfieldsolutions.hu/en/glossary/blue-team): The defensive side: hardening the systems, watching them, and handling it when something happens.
- [Penetration test](https://dfieldsolutions.hu/en/glossary/penetration-test): An authorised, scoped attempt to break into a system, done to find out what an attacker could actually achieve.
- [OWASP LLM Top 10](https://dfieldsolutions.hu/en/glossary/owasp-llm-top-10): A community list of the most significant security risks specific to applications built on large language models.
- [OWASP Top 10](https://dfieldsolutions.hu/en/glossary/owasp-top-10): The long-standing community list of the most critical web application security risks, revised every few years.
- [Data exfiltration](https://dfieldsolutions.hu/en/glossary/data-exfiltration): Getting data out of a system that was not supposed to let it leave.
- [Threat model](https://dfieldsolutions.hu/en/glossary/threat-model): A written answer to who would attack this, what they would want, and what would actually stop them.
- [Security audit](https://dfieldsolutions.hu/en/glossary/security-audit): A systematic review of a system against a standard or a set of criteria, aiming for coverage rather than for a way in.
- [Incident response](https://dfieldsolutions.hu/en/glossary/incident-response): The plan and the practice for what happens between noticing something is wrong and being back to normal.
- [Smart contract](https://dfieldsolutions.hu/en/glossary/smart-contract): A program deployed to a blockchain that runs exactly as written, that anyone can call, and that usually cannot be changed afterwards.
- [Solidity](https://dfieldsolutions.hu/en/glossary/solidity): The main language for writing smart contracts on Ethereum and the other chains that run the same virtual machine.
- [Gas](https://dfieldsolutions.hu/en/glossary/gas): The unit of computational cost on Ethereum-style chains: every operation has a price, and the caller pays it.
- [ERC-721](https://dfieldsolutions.hu/en/glossary/erc-721): The Ethereum standard for non-fungible tokens: a contract interface where every token has its own distinct identity and owner.
- [Smart contract audit](https://dfieldsolutions.hu/en/glossary/smart-contract-audit): An independent review of contract code before it goes live, looking for the ways it can be drained, locked or manipulated.
- [Core Web Vitals](https://dfieldsolutions.hu/en/glossary/core-web-vitals): Google's three field metrics for loading, responsiveness and visual stability, measured on real visits rather than in a lab.
- [LCP (Largest Contentful Paint)](https://dfieldsolutions.hu/en/glossary/lcp): The moment the biggest piece of content in the viewport finishes rendering — in practice, when the page looks loaded.
- [Hydration](https://dfieldsolutions.hu/en/glossary/hydration): The step where JavaScript takes over server-rendered HTML in the browser and makes it interactive.
- [Static generation (SSG)](https://dfieldsolutions.hu/en/glossary/static-generation): Rendering pages to HTML at build time, so a request is answered by handing over a file instead of running code.
- [CI/CD](https://dfieldsolutions.hu/en/glossary/ci-cd): Automatically building and testing every change, and automatically shipping the ones that pass.
- [Structured data](https://dfieldsolutions.hu/en/glossary/structured-data): Machine-readable markup — usually JSON-LD written in the schema.org vocabulary — that tells search and answer engines what the entities on a page are.
- [Answer engine optimization (AEO)](https://dfieldsolutions.hu/en/glossary/aeo): Structuring content so that answer engines — chat assistants and AI overviews — can find it, quote it and attribute it correctly.
- [n8n](https://dfieldsolutions.hu/en/glossary/n8n): An open-source workflow-automation tool that connects apps, APIs and AI models into repeatable pipelines — self-hostable, so data can stay on your own infrastructure.
- [Rate limiting](https://dfieldsolutions.hu/en/glossary/rate-limiting): A control that caps how many requests a client can make in a time window — the basic defence against brute force, scraping, abuse and runaway API costs.
- [WCAG](https://dfieldsolutions.hu/en/glossary/wcag): The Web Content Accessibility Guidelines — the standard that defines what makes web content usable by people with disabilities; AA contrast is 4.5:1 for body text.
- [Idempotency](https://dfieldsolutions.hu/en/glossary/idempotency): The property that performing an operation twice produces the same result as once — the thing that makes retries safe in payment, order and automation systems.
- [Token](https://dfieldsolutions.hu/en/glossary/token): The unit a language model reads and writes — a word fragment, word or punctuation mark — and the unit its cost and context limits are counted in.
- [Temperature](https://dfieldsolutions.hu/en/glossary/temperature): A sampling setting that controls how random a language model's output is — low values pick the most likely words, high values take more chances.
- [Transformer](https://dfieldsolutions.hu/en/glossary/transformer): The neural network architecture behind modern language models — attention layers that weigh which earlier words matter when predicting the next one.
- [Prompt engineering](https://dfieldsolutions.hu/en/glossary/prompt-engineering): The practice of writing model inputs so the output is reliably what you need — structure, examples, constraints and tone rather than hope.
- [Few-shot prompting](https://dfieldsolutions.hu/en/glossary/few-shot-learning): Teaching a model a task by putting examples of it inside the prompt — input and desired output pairs — instead of describing the task in words.
- [Chain of thought](https://dfieldsolutions.hu/en/glossary/chain-of-thought): Prompting a model to reason step by step before answering — accuracy on multi-step problems improves when the working is generated, not skipped.
- [AI guardrails](https://dfieldsolutions.hu/en/glossary/ai-guardrails): The checks around a model that constrain what it can say and do — input filters, output validation, permissioned tools — so a bad response fails safely.
- [AI chatbot](https://dfieldsolutions.hu/en/glossary/ai-chatbot): A conversational interface backed by a language model — useful when it answers from your real data and hands off gracefully when it cannot.
- [Knowledge base](https://dfieldsolutions.hu/en/glossary/knowledge-base): The maintained, structured store of facts a system answers from — documents, prices, policies — that a chatbot grounds on so it can only say what is true.
- [Workflow automation](https://dfieldsolutions.hu/en/glossary/workflow-automation): Making a repeated business process run itself — a trigger starts it, steps move the data between systems, and exceptions reach a human.
- [Webhook](https://dfieldsolutions.hu/en/glossary/webhook): A URL one system calls to tell another that something happened — the mechanism that lets automations react in seconds instead of polling.
- [Zapier](https://dfieldsolutions.hu/en/glossary/zapier): The best-known no-code automation platform — connects SaaS apps with trigger-action 'Zaps' without servers to run, priced per task.
- [CRM automation](https://dfieldsolutions.hu/en/glossary/crm-automation): Wiring the customer database so leads, follow-ups and status changes happen automatically — enquiry lands, lead is created, the right person is pinged.
- [Multimodal model](https://dfieldsolutions.hu/en/glossary/multimodal): A model that takes and produces more than text — images, audio, documents — so 'what is wrong in this photo' or 'read this invoice' is one call.
- [Speech to text](https://dfieldsolutions.hu/en/glossary/speech-to-text): Transcribing spoken audio into written text with a model — the front end of voice notes, call summaries and 'talk to the computer' interfaces.
- [OCR](https://dfieldsolutions.hu/en/glossary/ocr): Optical character recognition — turning images of text into real text, so scanned invoices, receipts and forms become data instead of pictures.
- [Diffusion model](https://dfieldsolutions.hu/en/glossary/diffusion-model): The image-generation architecture that starts from noise and removes it step by step — the engine behind Stable Diffusion and most modern image tools.
- [LangChain](https://dfieldsolutions.hu/en/glossary/langchain): A popular framework for building LLM applications — chains and agents that wire models to data sources, tools and memory.
- [Grounding](https://dfieldsolutions.hu/en/glossary/grounding): Tying a model's answers to real sources — retrieved documents, databases, live data — so it states what is true instead of what sounds right.
- [Agentic workflow](https://dfieldsolutions.hu/en/glossary/agentic-workflow): A pipeline where a model does not just answer but acts — calls tools, checks results, retries — inside a loop with real boundaries.
- [Cross-site scripting (XSS)](https://dfieldsolutions.hu/en/glossary/xss): An attack that injects hostile JavaScript into a page other people view — the browser runs the attacker's code with the victim's session.
- [CSRF](https://dfieldsolutions.hu/en/glossary/csrf): Cross-site request forgery — tricking a logged-in browser into sending a request the user never meant, riding on their cookies.
- [SQL injection](https://dfieldsolutions.hu/en/glossary/sql-injection): Smuggling database commands through input fields — the attack that turns 'name' into 'show me every user's password hash'.
- [MFA / 2FA](https://dfieldsolutions.hu/en/glossary/mfa): Multi-factor authentication — proving identity with something you know plus something you have, so a leaked password alone cannot log in.
- [Password hashing](https://dfieldsolutions.hu/en/glossary/password-hashing): Storing a one-way, salted, deliberately slow fingerprint of each password — so a stolen database is a puzzle, not a list.
- [JWT](https://dfieldsolutions.hu/en/glossary/jwt): JSON Web Token — a signed, self-contained credential a server can verify without a database lookup; the standard way APIs say 'this request is you'.
- [OAuth](https://dfieldsolutions.hu/en/glossary/oauth): The authorization protocol behind 'Sign in with Google' — lets a service act on your behalf with a scoped token instead of your password.
- [Session hijacking](https://dfieldsolutions.hu/en/glossary/session-hijacking): Stealing the token that proves a logged-in session — whoever holds it is you, no password needed.
- [Encryption at rest](https://dfieldsolutions.hu/en/glossary/encryption-at-rest): Encrypting data where it is stored — disks, databases, backups — so a stolen drive or leaked dump is ciphertext, not data.
- [TLS](https://dfieldsolutions.hu/en/glossary/tls): Transport Layer Security — the encryption layer behind HTTPS that keeps traffic private and proves the site you reached is the site you meant.
- [Zero trust](https://dfieldsolutions.hu/en/glossary/zero-trust): A security model that trusts nothing by default — every request is verified by identity and context, even inside the network.
- [Least privilege](https://dfieldsolutions.hu/en/glossary/least-privilege): Every user, service and process gets only the access the job requires — nothing more, so a compromise has a small blast radius.
- [Security headers](https://dfieldsolutions.hu/en/glossary/security-headers): HTTP response headers that tell browsers how to handle the page safely — HSTS, CSP, X-Frame-Options — free defences most sites skip.
- [Content Security Policy](https://dfieldsolutions.hu/en/glossary/csp): A header that whitelists where a page's scripts, styles, images and connections may come from — the second wall that stops XSS even when injection happens.
- [Supply-chain attack](https://dfieldsolutions.hu/en/glossary/supply-chain-attack): Attacking you through something you trust — a poisoned dependency, a compromised build tool — instead of attacking you directly.
- [SBOM](https://dfieldsolutions.hu/en/glossary/sbom): Software bill of materials — the inventory of every component and version inside a piece of software, so 'are we vulnerable to X' is a lookup, not an excavation.
- [Secrets management](https://dfieldsolutions.hu/en/glossary/secrets-management): Keeping API keys, passwords and certificates out of code and chat — in a vault, rotated, access-logged — so one screenshot is not a breach.
- [Ransomware](https://dfieldsolutions.hu/en/glossary/ransomware): Malware that encrypts your files and sells the key back to you — the attack where your backups decide whether it is a bad week or a closed business.
- [Phishing](https://dfieldsolutions.hu/en/glossary/phishing): Tricking people into handing over credentials or clicking the payload — the front door of most breaches, because it attacks the part that cannot be patched.
- [GDPR](https://dfieldsolutions.hu/en/glossary/gdpr): The EU's data-protection regulation — consent before collection, rights to access and deletion, breach notification in 72 hours, fines up to 4% of turnover.
- [Data minimization](https://dfieldsolutions.hu/en/glossary/data-minimization): Collecting and keeping only the data the job needs — the GDPR principle that is also the cheapest security control: what you do not hold cannot leak.
- [3-2-1 backup rule](https://dfieldsolutions.hu/en/glossary/backup-3-2-1): Three copies of your data, on two different media, one of them off-site — the floor under every 'we have backups' claim.
- [Solana](https://dfieldsolutions.hu/en/glossary/solana): A high-throughput, low-fee blockchain — thousands of transactions a second at fractions of a cent — built for applications that need speed.
- [Anchor](https://dfieldsolutions.hu/en/glossary/anchor-framework): The Rust framework for Solana programs — generates the boilerplate and enforces the checks raw Solana development makes easy to forget.
- [PDA](https://dfieldsolutions.hu/en/glossary/pda): Program-derived address — a Solana account whose address is computed from seeds, owned by a program, with no private key to steal.
- [SPL token](https://dfieldsolutions.hu/en/glossary/spl-token): Solana's token standard — the shared program every fungible and non-fungible token on the chain uses, so wallets and apps speak one format.
- [Crypto wallet](https://dfieldsolutions.hu/en/glossary/crypto-wallet): The thing that holds your keys, not your coins — signs transactions to prove 'it was me' without ever showing the private key.
- [On-chain](https://dfieldsolutions.hu/en/glossary/on-chain): Recorded on the blockchain itself — permanent, public, verifiable by anyone — as opposed to off-chain data in someone's database.
- [RPC node](https://dfieldsolutions.hu/en/glossary/rpc-node): The server your app talks to instead of the blockchain directly — reads chain state and submits transactions; its reliability is your app's reliability.
- [DeFi](https://dfieldsolutions.hu/en/glossary/defi): Decentralized finance — lending, trading and yield run by smart contracts instead of institutions, open to anyone with a wallet.
- [Consensus mechanism](https://dfieldsolutions.hu/en/glossary/consensus-mechanism): How a blockchain's nodes agree on which transactions happened and in what order — proof of work, proof of stake, and their variants.
- [MEV](https://dfieldsolutions.hu/en/glossary/mev): Maximal extractable value — profit from reordering, inserting or censoring transactions in a block; the invisible tax on unprotected swaps.
- [ERC-20](https://dfieldsolutions.hu/en/glossary/erc-20): The fungible-token standard on Ethereum — the interface (transfer, balanceOf, approve) that makes any token work with any wallet or exchange.
- [Merkle proof](https://dfieldsolutions.hu/en/glossary/merkle-proof): A compact cryptographic proof that one item belongs to a big set — verify a leaf against the root hash without holding the whole tree.
- [Server-side rendering (SSR)](https://dfieldsolutions.hu/en/glossary/ssr): Generating the page's HTML on the server per request — the browser gets a complete page, not a loader and a promise.
- [Client-side rendering (CSR)](https://dfieldsolutions.hu/en/glossary/client-side-rendering): Sending a JavaScript bundle that builds the page in the browser — flexible, but the first paint waits for the code to download and run.
- [CDN](https://dfieldsolutions.hu/en/glossary/cdn): Content delivery network — copies of your assets on servers near your visitors, so 'far away' stops meaning 'slow'.
- [Edge computing](https://dfieldsolutions.hu/en/glossary/edge-computing): Running code on the CDN's edge servers — close to the user — instead of one origin far away; personalization without the round trip.
- [HTTP caching](https://dfieldsolutions.hu/en/glossary/http-caching): Headers that tell browsers and CDNs how long a response may be reused — the cheapest performance optimization that exists.
- [DNS](https://dfieldsolutions.hu/en/glossary/dns): Domain Name System — the lookup that turns dfieldsolutions.com into a server address; when it breaks, everything looks broken.
- [Canonical URL](https://dfieldsolutions.hu/en/glossary/canonical-url): A tag naming the one 'real' address for content reachable at several URLs — so search engines rank the copy you meant, once.
- [hreflang](https://dfieldsolutions.hu/en/glossary/hreflang): Annotations that tell search engines which language and region each version of a page targets — so the Hungarian searcher gets the Hungarian page.
- [XML sitemap](https://dfieldsolutions.hu/en/glossary/xml-sitemap): A machine-readable list of every URL worth indexing — last-modified dates included — so crawlers find all of it, fast.
- [robots.txt](https://dfieldsolutions.hu/en/glossary/robots-txt): A plain-text file at the site root telling crawlers what they may fetch — an instruction to machines, not a lock on a door.
- [Open Graph](https://dfieldsolutions.hu/en/glossary/open-graph): The meta tags that control how a link looks when shared — the title, description and image in every Slack, WhatsApp and social preview.
- [llms.txt](https://dfieldsolutions.hu/en/glossary/llms-txt): A proposed convention — a markdown file at the site root giving AI assistants a clean map of the content worth reading.
- [Local SEO](https://dfieldsolutions.hu/en/glossary/local-seo): Being found when people near you search — the map pack, 'near me' queries, and the Google Business Profile that drives most of it.
- [NAP consistency](https://dfieldsolutions.hu/en/glossary/nap-consistency): Name, address, phone — written identically everywhere your business appears, because conflicting details make search engines trust none of them.
- [Google Business Profile](https://dfieldsolutions.hu/en/glossary/google-business-profile): The free listing that puts a business on Google Maps and the local pack — categories, hours, photos and the reviews that decide local trust.
- [Indexing](https://dfieldsolutions.hu/en/glossary/indexing): A search engine adding a page to its searchable database — crawling fetches it, indexing makes it findable; unindexed is invisible.
- [301 redirect](https://dfieldsolutions.hu/en/glossary/redirect-301): A permanent 'it moved' answer — sends visitors and nearly all ranking credit from the old URL to the new one.
- [ARIA](https://dfieldsolutions.hu/en/glossary/aria): Accessible Rich Internet Applications — attributes that tell assistive technology what your markup means when HTML alone cannot.
- [Semantic HTML](https://dfieldsolutions.hu/en/glossary/semantic-html): Using elements that mean what they contain — nav, article, button — so screen readers, crawlers and browsers understand the page for free.
- [PWA](https://dfieldsolutions.hu/en/glossary/pwa): Progressive web app — a website that installs like an app: home-screen icon, offline behavior, push, all from the same URL.
- [Service worker](https://dfieldsolutions.hu/en/glossary/service-worker): A script the browser runs between your page and the network — intercepts requests to cache, serve offline and sync in the background.
- [Design system](https://dfieldsolutions.hu/en/glossary/design-system): The shared vocabulary of a product's UI — tokens, components and rules — so every new screen looks like the same product built it.
- [Internationalization (i18n)](https://dfieldsolutions.hu/en/glossary/internationalization): Building a product so it can be localized — text, dates, URLs and layouts — rather than retrofitting languages into an English-only shell.
- [SEO](https://dfieldsolutions.hu/en/glossary/seo): Search engine optimization — making pages findable, indexable and worth ranking: technical health plus content people actually want.
- [Conversion rate optimization (CRO)](https://dfieldsolutions.hu/en/glossary/conversion-rate-optimization): Raising the share of visitors who do the thing — buy, book, enquire — by fixing friction, not by buying more traffic.
- [Uptime monitoring](https://dfieldsolutions.hu/en/glossary/uptime-monitoring): An outside service pinging your site every minute and alerting when it stops answering — so you hear about the outage before your customers do.
- [SERP](https://dfieldsolutions.hu/en/glossary/serp): Search Engine Results Page — the page Google shows for a query, now a mix of blue links, AI overviews, map packs, and ads.
- [E-E-A-T](https://dfieldsolutions.hu/en/glossary/eeat): Experience, Expertise, Authoritativeness, Trustworthiness — the quality lens Google's human raters apply, with Trust weighted heaviest.
- [Backlink](https://dfieldsolutions.hu/en/glossary/backlink): A link from another site to yours — still the strongest external ranking signal, valued by quality and relevance, not count.
- [Keyword research](https://dfieldsolutions.hu/en/glossary/keyword-research): Finding out which words people actually type when they need what you sell — the input to every content decision.
- [Title tag](https://dfieldsolutions.hu/en/glossary/title-tag): The HTML title — the blue headline in search results and the strongest single on-page relevance signal.
- [Meta description](https://dfieldsolutions.hu/en/glossary/meta-description): The page summary shown under the title in results — no direct ranking weight, but it writes your ad copy.
- [Search intent](https://dfieldsolutions.hu/en/glossary/search-intent): What the searcher actually wants from a query — to learn, to go somewhere, to compare, or to buy. The thing the page must match.
- [Featured snippet](https://dfieldsolutions.hu/en/glossary/featured-snippet): The boxed answer Google lifts to the top of results — 'position zero' — pulled from a page that already ranks and answers cleanly.
- [Knowledge Graph](https://dfieldsolutions.hu/en/glossary/knowledge-graph): Google's database of real-world entities and their relationships — what lets it answer 'who founded X' without quoting a page.
- [Topical authority](https://dfieldsolutions.hu/en/glossary/topical-authority): Being the site that covers a subject completely — many well-linked pages on one topic beat one page on many topics.
- [Internal linking](https://dfieldsolutions.hu/en/glossary/internal-linking): Links between your own pages — how authority flows to the pages that need it and how crawlers and readers find depth.
- [Anchor text](https://dfieldsolutions.hu/en/glossary/anchor-text): The clickable words of a link — a description of the destination that search engines read as a relevance vote.
- [Organic traffic](https://dfieldsolutions.hu/en/glossary/organic-traffic): Visitors who arrive from unpaid search results — the compounding channel that keeps working after the work is done.
- [Domain authority](https://dfieldsolutions.hu/en/glossary/domain-authority): The accumulated trust a whole site carries — Google's own version is invisible; the public metrics are third-party approximations.
- [Crawl budget](https://dfieldsolutions.hu/en/glossary/crawl-budget): How much of your site Googlebot is willing to fetch — only a constraint on large sites, but a real one there.
- [Mobile-first indexing](https://dfieldsolutions.hu/en/glossary/mobile-first-indexing): Google indexes the mobile version of a site, not the desktop one — whatever the mobile page lacks does not exist for ranking.
- [Lighthouse](https://dfieldsolutions.hu/en/glossary/lighthouse): Google's open-source audit tool — scores performance, accessibility, best practices and SEO in a lab environment.
- [Alt text](https://dfieldsolutions.hu/en/glossary/alt-text): The text alternative on an image — what screen readers announce and what image search indexes.
- [INP](https://dfieldsolutions.hu/en/glossary/inp): Interaction to Next Paint — the Core Web Vital that measures how fast a page responds to taps and clicks, replacing FID since 2024.
- [CLS](https://dfieldsolutions.hu/en/glossary/cls): Cumulative Layout Shift — the Core Web Vital measuring how much the page jumps around while loading.
- [MVP](https://dfieldsolutions.hu/en/glossary/mvp): Minimum Viable Product — the smallest version that tests the real hypothesis, not a cheap version of the whole thing.
- [Retainer](https://dfieldsolutions.hu/en/glossary/retainer): An ongoing engagement — a reserved slice of engineering capacity per month instead of one-off projects.
- [Discovery call](https://dfieldsolutions.hu/en/glossary/discovery-call): The first conversation before any proposal — where scope, budget reality and fit get established instead of guessed.
- [Social proof](https://dfieldsolutions.hu/en/glossary/social-proof): Evidence that others already trusted you — reviews, named clients, numbers — the shortest path past a stranger's scepticism.

## Case studies (23)
- [3D AI Property](https://dfieldsolutions.hu/en/work/3d-ai-property): AI-generated 3D properties and interiors, walkable in FPV · with a manual editor and drone view.
- [AI Chatbot Maker](https://dfieldsolutions.hu/en/work/ai-chatbot-maker): One-click SaaS to build a company's own AI chatbot · upload a folder, point at a site feed, everything stays on your server.
- [AIHealthIQ](https://dfieldsolutions.hu/en/work/aihealthiq): AI reads your wearable data, spots changes, recommends treatment and lifestyle tweaks.
- [AutoImport](https://dfieldsolutions.hu/en/work/autoimport): EU→HU car-import arbitrage platform - turns 'you can buy this car abroad and resell it at home' into a live, scored feed.
- [AxisFit](https://dfieldsolutions.hu/en/work/axisfit): 3D-driven functional-training app - web + mobile share one bone-rig engine that animates every exercise.
- [BetEdge](https://dfieldsolutions.hu/en/work/betedge): Data-driven bet analyser · parlay suggestions, best odds, probability math, not guesswork.
- [ClarixAI](https://dfieldsolutions.hu/en/work/clarixai): A misconception-pattern radar for teachers · open-ended student answers in, the reasoning errors dominating a cohort out.
- [GlowUp](https://dfieldsolutions.hu/en/work/glowup): Self-improvement mobile app on iPhone and Android · goals, daily challenges, TikTok-style short content.
- [MCP Security Layer](https://dfieldsolutions.hu/en/work/mcp-security): A security layer between an AI agent and its tools · checks every tool call at the intent level, blocks or approves, logs.
- [Multi-Agent Crypto Trading](https://dfieldsolutions.hu/en/work/multi-agent-crypto-trading-system): Multiple AI agents trade the top 50 crypto tokens together · data, sentiment, news in one.
- [PhisGuard](https://dfieldsolutions.hu/en/work/phisguard): AI-powered phishing simulation campaigns for companies · realistic scenarios, live tracking, automated awareness training.
- [The Truth AI News](https://dfieldsolutions.hu/en/work/ai-news): The only news aggregator that verifies the source, summarises it, and scores how biased the piece is.
- [all 23 case studies](https://dfieldsolutions.hu/en/work)

## Contact
- Email: dezso@dfieldsolutions.com
- Book a 30-minute call: https://calendar.app.google/jGgfe2Pgi66XMoY9A
- [Contact page](https://dfieldsolutions.hu/en/contact)

## Questions this studio gets asked
- [Answers, in full](https://dfieldsolutions.hu/en/contact) — https://dfieldsolutions.hu/en/_/faq.md
- What does DField Solutions do?
- Who will I actually be working with?
- Where are you based, and do you work remotely?
- How long does a project take?
- How does it start, and what does the first conversation cost?
- Do I own the code when it is finished?
- What does Purple Team mean?
- Can you secure an AI agent against prompt injection?
- What do you build with?
- Do you have your own products, or only client work?
- What if I do not have a specification yet?
- Can you take over an existing codebase?
- Can you do one piece of work instead of the full eight weeks?
- What actually happens in the first two weeks?
- How will I know it is going well while it is being built?
- Do you work with agencies and other studios?
- How do I know your security work is real and not a scanner report?
- We already have AI in production and it is misbehaving. Can you help with that?
- Which blockchains do you work on?
- Do you build mobile apps?
- Do you host and run things, or hand everything over?
- There is a free AI security self-audit on your site. What is it?
- I am not sure which of your services I need.
- Do you write about what you do?

## Optional
- [Full text of every page](https://dfieldsolutions.hu/llms-full.txt)
- [How this site was built](https://dfieldsolutions.hu/en/lab/workshop-with-comfyui)
- [Terms for AI crawlers](https://dfieldsolutions.hu/ai.txt)
- [Lab feed](https://dfieldsolutions.hu/feed.xml) · [Atom](https://dfieldsolutions.hu/feed.atom) · [JSON](https://dfieldsolutions.hu/feed.json)
- [Who built this](https://dfieldsolutions.hu/humans.txt)
- [The same map in Hungarian](https://dfieldsolutions.hu/llms-hu.txt)
- [The same map in German](https://dfieldsolutions.hu/llms-de.txt)