Security check and pentest for your web application
- Reply < 24 hrs
- Fixed price upfront
- A deal is a deal
- Certified
What you get
- Working software, not half-built
- Fixed price and deadline upfront
- Documentation and a clean handover
- Aftercare, I stay reachable
Tech
How I approach it
Testing like an attacker, fixing like a developer
- 1 Agreeing the scope What may I test, when and how? All in writing.
- 2 Attacking I look for weak spots the way an attacker would.
- 3 Closing the gaps I fix the leaks, or give your developer exactly what is needed.
- 4 Retest and report Tested again, with a report in plain language.
Findings
- Login and sessions Checking No 2FA Secured
- Other customers' data Checking Retrievable Shielded
- Injection and XSS Checking 2 leaks Closed
- Server settings Checking Port open Closed
- Leaked secrets Checking .env public Removed
What I test
- Login, password reset and sessions
- Access to data of other users or customers
- Injection, XSS and unsafe file uploads
- API endpoints without proper authorisation
- Server settings, open ports and outdated software
- Leaked secrets in code, logs or public files
A report you understand
Then closing the gaps
Questions
Frequently asked questions
Is this legal?
Yes, as long as the owner of the system gives written permission. I only test systems you can authorise, and we agree up front what is and is not in scope.
Will my site go down during the test?
No. I test carefully and avoid anything that could overload your system. Where possible I test on a staging environment.
Does this help with GDPR?
Yes. GDPR requires appropriate protection of personal data. A test with a report shows you take that seriously and where you still need to improve.
Client feedback
What clients say
Sounds like what you need?
Response within 24 hours. Free intro call. Honest pricing.