What we do instead
We run the tools, then we prove every result by hand.
01
A scanner reports it
We reproduce it
If we cannot exploit it, it does not go in the report as a finding. You are not paying us to forward a tool's guesses.
Services / Security audit
Find the holes
before somebody else does.
A security audit done by people, not by a scanner.
Every finding is verified by hand and written up with the exact steps to reproduce it and to fix it.
Findings verified by hand 100%Retest after your fix included
01 / the difference
A scanner finds
noise.
Most cheap audits are an automated report forwarded to you. You get four hundred findings, most of them wrong, and no idea which one matters.
What you will not get
0 false alarms
No wall of "informational" items to pad the page count. A short report you can act on beats a long one nobody reads.
What you will get
1 fix path
Each finding comes with the steps to reproduce it, the risk in plain language, and the change we would make to close it.
02 / what we look at
Where things
actually break.
We work from the OWASP Top 10 as a floor, not a ceiling. Real attacks chain small mistakes together, so we look at how the parts behave as a system.
01Authentication and sessionsLogin, password reset, session lifetime, token handling, multi-factor gaps, and the paths that let someone skip a step.
02Authorization boundariesWhether one user can reach another user's data by editing an id, a URL or a request. The most common serious bug we find.
03Injection and input handlingSQL, command and template injection, unsafe deserialization, and every place user input reaches something that executes.
04Client side and XSSStored, reflected and DOM-based cross-site scripting, CSRF, clickjacking, and what your Content Security Policy actually blocks.
05APIs and rate limitsUndocumented endpoints, missing authorization on internal routes, mass assignment, and what happens under abuse.
06Files, uploads and storageUpload handling, path traversal, public buckets, and whether a leaked URL is enough to read something private.
07Dependencies and supply chainKnown vulnerable packages, unpinned versions, and build-time risks in your CI pipeline.
08Infrastructure and headersCertificate setup, browser security settings, services left open to the internet, default passwords, and what your server reveals about itself.
09Secrets and configurationKeys in the repository or the bundle, verbose errors, debug endpoints left open, and logs that record more than they should.
03 / the report
Written for the person
who has to fix it.
One document, two audiences. A summary your management can read in five minutes, and a technical section your developers can work from directly.
CriticalSomeone can take data or control right now. Fix this week, and we will help.
HighExploitable with effort or with one more mistake. Fix this month.
MediumReal risk, but it needs conditions to line up. Put it in the next sprint.
LowWorth closing, no rush. We say so plainly instead of inflating it.
01
Steps to reproduce
The exact request, payload or click path. Your developer can see it happen on their own machine before changing a line.
02
The risk, in plain words
What an attacker gets, and what it would cost you. No CVSS score without a sentence explaining what it means for your business.
03
The fix we would make
The specific change, not "sanitize your inputs". If you want us to implement it, that is quoted separately and you are never obliged.
04 / how it runs
Agreed first.
Tested after.
Nothing is touched before it is written down and signed. Testing without written authorization is not a service, it is a crime.
01
Scope and permission
We agree in writing what is in scope, what is off limits, when we test, and who to call if something goes wrong. You sign it before we start.
02
We test
Usually five to ten working days. If we find something critical we tell you the same day, not at the end.
03
Report and walkthrough
You get the document, then a call where we go through it with your developers and answer questions.
04
Retest
After you fix, we test the same findings again and issue a short confirmation. That retest is included, not an upsell.
05 / packages
Fixed scope.
Fixed price.
You know the number before we start. If the scope turns out to be bigger than it looked, we tell you and you decide, never after the fact.
Launch offer · 10% off every price
Essential
One web application or site. A first honest look at where you stand.
$4,410, 10% off $4,900
One-time · about 5 working days
- One application, authenticated and public paths
- OWASP Top 10 coverage
- Every finding verified by hand
- Written report and walkthrough call
- One retest after your fixes
- No infrastructure or API deep dive
Most chosen
Full
An application with an API, users and a server you own.
$10,710, 10% off $11,900
One-time · about 10 working days
- Everything in Essential
- API and authorization boundary testing
- Server and certificate review
- Dependency and secrets review
- Two retests within 90 days
- Remediation support on call
Continuous
Systems that change every week and cannot wait a year to be tested.
Custom
Quarterly · scoped with you
- Everything in Full, every quarter
- Security checks built into your pipeline
- Review of new features before release
- A named engineer who knows your system
- Priority response to disclosures
- Evidence pack for client questionnaires
Not sure which one fits? The free performance audit is the cheapest way to find out. It costs nothing and it tells us both what we are looking at.
06 / questions
The things people
actually ask.
Will testing take my site down?
It should not, and we plan it so it does not. Load-heavy checks are agreed in advance and usually run outside your busy hours. We keep a contact on call during testing so anything unexpected is stopped in minutes, not hours.
Do you need our source code?
Not necessarily. Testing without it is closer to what a real attacker sees. Testing with it finds more, faster, for the same money. We will tell you which one fits your situation and why.
What if you find nothing serious?
Then the report says so, and that is a real result you can show a client or an investor. We do not inflate low findings to justify an invoice. Our reputation is worth more than one project.
Who sees the report?
You. We do not name clients or publish findings without written permission, and we hold nothing on our side longer than the engagement needs. If you want us to sign your NDA first, send it.
Can you fix what you find?
Yes, quoted separately, and you are never obliged. Some clients hand the report to their own team, and that is a good outcome too. We would rather the hole gets closed than that we get the work.
Do we get a certificate?
You get a letter of attestation stating the scope, the dates and the state of the findings after retest. That is what a serious client or auditor asks for. Anyone selling you a badge without a scope is selling you a picture.
07 / start here
Send us a URL.
We'll tell you what hurts.
The free performance audit is the door. It costs nothing, it takes 48 hours, and it tells us both whether a full security audit is worth your money.