Website and application security
We review the software, access and configuration behind your website or application, then help you address the weaknesses we can verify. You receive a written record of the findings, the priorities and the work agreed.
We agree the scope and price before testing. Your inquiry starts a conversation.
An example of the report format
EX-01Illustrative example, not a client finding or a scan of your website.
Access control
A test account can read an invoice belonging to another account. The report records the affected route, the accounts used and the observed response, with sensitive details removed.
GET /invoices/redactedsession redactedaccount B200 OKinvoice owned by account AWhat we examine
The scope follows the system you run. A public website and an application with customer accounts need different checks.
01
Runtime and framework versions, plugins, dependencies and relevant vendor advisories. We verify exposure and available fixes against the actual setup.
02
Administrative access, account permissions, HTTPS, exposed services and security settings. The checks depend on the access you authorize.
03
For application reviews, agreed login, session, upload and account-boundary checks. Roles and business workflows are named in the scope.
04
Backup arrangements, evidence of restore checks and configuration that affects reliability. Performance improvements are scoped alongside security changes when relevant.
01
We agree the domains, environments, accounts, checks, exclusions and safe testing window. Active testing starts only with written authorization.
02
We combine inventory and configuration checks with manual verification. Application checks use relevant OWASP WSTG guidance within the agreed scope.
03
You receive an owner summary and technical findings with evidence, impact, proposed fixes and anything we could not verify. Your team can use the report independently.
04
Your developer or our team implements the agreed work. Each review includes one retest of its findings within 30 days of the report, after you tell us the fixes are ready.
Packages
Find out what needs attention and why.
Website: one site, software inventory and accessible configuration checks, 3–5 business days. Application: up to 2 roles and 3 agreed workflows, 5–10 business days. Both include a report and one retest within 30 days.
Source-code review, additional environments and deeper penetration testing require a separate scope.
per agreed engagement
Address an agreed list of weaknesses.
Up to 8 engineering hours for agreed updates, access controls or configuration changes, with a backup/rollback plan, change record and verification. Typical window: 5–10 business days after scope and access are ready.
The review is separate. Larger migrations, malware recovery and third-party licences are quoted separately; additional work needs your approval.
per agreed engagement
Keep an owner for routine security work.
One site after an initial review and onboarding. Uptime/TLS and dependency alerts where supported, a monthly security review and report, and up to 1 hour of engineering per month. Work is handled during business hours.
Onboarding and remediation are separate. Monitoring is automated; this is not a staffed 24/7 response service. Extra work is agreed separately. Monthly, with 30 days’ notice to cancel.
per month
Starting prices are final EUR prices for the stated scope. We confirm a written quote and delivery window after reviewing your setup. Hosting and third-party charges are separate. Testing windows start once permission and access are ready.
We state what we checked, what access we had and what remains unverified. A security review reduces uncertainty; it cannot certify that a system is safe or establish whether it was previously compromised. Compliance certification, forensic investigation and emergency response need a separately qualified engagement.
Before we begin
Yes. Say that you suspect an active incident so we can assess whether we can help and agree a separate recovery scope. Contact your hosting provider promptly and preserve logs and backups. This form is not an emergency response channel.
Yes. The report includes technical evidence and an actionable fix list. Your team can implement the work, or we can quote agreed changes. Access and responsibilities are settled before testing.
No. An inquiry is a request to discuss the work. We agree ownership, written authorization, scope and a safe testing window before active checks.
An appropriate vendor update addresses the vulnerabilities covered by that update. It does not establish whether an earlier compromise occurred or whether the application has other weaknesses. We verify the actual version and deployment rather than infer it from the public page.
The security review is a focused engagement with evidence and priorities. Ordinary care plans cover routine website maintenance; security care adds the agreed security review and alert workflow. We check your existing coverage so the same work is not charged twice.
Start with your website
Share the website or application and what prompted the review. We’ll reply within 24 hours to discuss fit, access and scope before any testing or paid work.
Prefer a conversation?Free 10-minute call
Web security inquiry