Built by someone who spent nearly nineteen years inside Liferay, from the core engineering team to Customer Experience Manager. The auditors know Liferay's security reports, release lines and URL layout. The journeys follow the go-live checklist step by step.

Who built this
Founder of 37 Audits. Nearly nineteen years at Liferay, from the core engineering team to Customer Experience Manager, most of them on the customer side of escalations. The auditors and journeys on this page come out of that experience: the things that actually break Liferay sites in production.
LinkedIn profile2024 – 2026
Customer Experience Manager, LATAM
Led the Solution Architects and Customer Experience Managers who keep Liferay’s largest customers in Latin America running, and was the single point of contact when a critical site went down. Every escalation ended with the same question: how do we make sure this never happens again? 37 Audits is the answer.
2022 – 2023
Product Owner, Liferay Cloud
Owned the roadmap and backlog for Liferay Cloud, turning customer and field feedback into shipped features.
2019 – 2022
Lead Solution Architect, Liferay Cloud
Designed and reviewed architectures for Liferay's largest accounts on Liferay Cloud: sizing, clustering, performance tuning and go-live readiness.
2016 – 2019
Senior Architect, LATAM
Architecture authority for Latin American customers and partners: solution design, performance troubleshooting and upgrade planning across banking, government and telecom.
2012 – 2016
Professional Services Manager, LATAM
Built and ran Liferay's consulting team for Latin America, delivering implementations, upgrades and performance engagements for enterprise customers.
2010 – 2011
Consultant and Training Manager, Brazil
CE to EE migrations, architecture reviews and code audits, an intranet for one of the largest telecoms in Brazil.
2007 – 2010
Software Engineer, Liferay core
Maven support, mailing-list integration and the Brazilian Portuguese translation of Liferay Portal.
One switch turns generic checks into Liferay checks: the stack you declare on the URL.
Put the public site, the intranet or a staging host in a project. Sites behind basic auth work too.
Pick Liferay DXP or Portal and the version. The form validates it against Liferay’s own release list, so a typo never silences a check.
CVE, End of Life and Latest Version compare your version with Liferay’s security reports, service-life policy and releases. Search, Protected URL and Cache probe the paths Liferay exposes.
Three guided paths turn the Liferay go-live checklist into steps you can tick off, with auditors verifying each one and manual steps for what only you can see.
Generic auditors with a Liferay visitor inside. Declare your stack as Liferay and they check against Liferay's own security reports, service-life policy, release list and URL layout.
Reads the DXP or Portal version from your Stack and compares it with Liferay's security advisories. Fails on CVSS 7.0 or higher.
Knows the Liferay Service Life policy for every DXP line. Warns a year before end of life and fails six months out. Portal CE only warns.
Checks Liferay's releases.json. Fails when a newer fix release exists in your line and warns when a newer line is available.
Probes /search with empty and wildcard queries and an oversized delta to confirm page-size caps, timeouts and no open redirects in pagination.
Confirms the control panel, /o/api, /api/jsonws and /c/portal/json_service answer 401, 403 or 404, or redirect to login.
Checks that Document Library files under /documents/ are served with Cache-Control: public so a CDN can cache them.
Secure it, make it fast, keep it online. Each journey mixes auditors with the manual steps from the Liferay go-live checklist, and remembers where you stopped.
Patch what is vulnerable, close the endpoints Liferay exposes by default, and harden TLS, cookies and headers. Part one of the Liferay series.
Measure, fix how pages are delivered, then tune the JVM, Liferay and Elasticsearch. Part two of the Liferay series.
Catch what expires, make the site fail cleanly, limit what can overload it, and be able to lose a server. Part three of the Liferay series.
Every account starts with free credits. Add the URL, declare the stack and run the six Liferay auditors in a minute.
37 Audits is an independent product and is not affiliated with, endorsed by or sponsored by Liferay, Inc. Liferay is a trademark of Liferay, Inc.