Diego Betto · Technical consulting for companies
I'm Diego Betto, Co-Founder & CTO of PAPION. My team and I help companies, agencies, and product teams design, build, and secure scalable React, Node.js, TypeScript, PHP, WordPress, and WooCommerce applications.
End-to-end technical consulting, from frontend to security, for companies that need to scale without surprises.
Design and scalability for React, Next.js, and Astro applications: maintainable components, solid performance, less technical debt over time.
Development and optimization of Node.js, Fastify, TypeScript, and PHP APIs: reliable services built to handle business growth.
Custom WordPress sites and WooCommerce stores: bespoke PHP themes and plugins, ERP and payment integrations, performance, and security hardening.
Hands-on support for dev teams to raise TS/JS code quality, cut production bugs, and speed up onboarding.
Application hardening, dependency/CVE monitoring, Core Web Vitals optimization.
Generative Engine Optimization: we prepare your site so ChatGPT, Gemini, Perplexity and Google's AI Overviews understand it and cite it as a source.
Explore the GEO service →
My name is Diego Betto. I am Co-Founder & CTO, senior software engineer with AI skills at PAPION, with 20+ years of experience. I'm based in Udine, Italy, working mostly remotely for clients across the country. I work across frontend and backend architecture, LLM and AI agent integration, application security, and mentoring other developers, with particular depth in React, JavaScript/TypeScript, and Node.js.
Learn more →Detailed case studies coming soon — in the meantime, here are the contexts we work in most often with PAPION.
High-traffic React frontends and order-management system integrations.
Node.js/Fastify backends for growing products, with a focus on security and observability.
Code review, mentoring, and security hardening without slowing delivery down.
Technical notes on React, Node.js, security, and performance.
HTTP2Shell (CVE-2026-111497, CVSS 9.2) is a Brotli decoder bug that Wordfence exploited in the lab against WordPress via XML-RPC pingbacks, even on patched PHP 8.3.36. Who is exposed, how to check and how to fix it.
Beyond the chat widget: how to connect an LLM to React, Vue or Svelte components with Vercel AI SDK, let the AI take actions, generate UI in real time and keep the user in control.
Run accessibility like privacy: roles, WCAG-EM audits, a testing cadence, CI with a baseline, production monitoring, accessibility statements and vendors.
What turns up when you apply a GEO checklist to a real site: duplicate entities, unescaped JSON-LD, missing dates, ambiguous topics, no Markdown and AI crawlers blocked by the CDN.
What Generative Engine Optimization is, how ChatGPT, Gemini, Perplexity and AI Overviews choose which sources to cite, what it delivers and where to start.
PHP2Shell: two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) allowing unauthenticated RCE. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: who is exposed, how to update and what to do if you can't.
A technical guide to Generative Engine Optimization: JSON-LD as an entity graph, typed schema markup in TypeScript, extractable content, AI-friendly formats and how to measure citations.
Tell me about your technical challenge: architecture, performance, security, or a team that needs reinforcing. I answer every email personally.