Know exactly where you are exposed, and what to fix first.
A clear, prioritised review of your website or app’s security.
- CriticalAdmin API reachable without a sessionAPI · /admin/█████
- HighPassword reset token does not expireAuth · reset flow
- HighSecret key committed to repositoryRepo · config/█████.ts
- MediumNo rate limit on sign-up and OTPAPI · /auth/████
- LowMissing security headersWeb · all pages
Illustration of our report format. Details are invented and redacted.
Audit
$2,400Prices in USD. Pay in your local currency at checkout.
A full audit of one web app and its API.
- One web app + its API
- Authentication and session review
- Access control by role
- OWASP Top 10 checks
- Hosting and cloud configuration
- Findings call with your team
- One free re-test
NDA on request · Authorised testing only · Reports shared only with you
We review your website or app the way an attacker would look at it: configuration, authentication, access control, exposed data, dependencies and hosting. You get a plain-English report with every finding ranked by risk and a fix for each.
We only test systems you own or are authorised to test, and we agree the scope in writing before we start.
Our engineers implement the fixes. Shown as an estimate; final quote after the report
Add another system to the same audit
A signed letter summarising scope and results for partners
- 01Written authorisation from the owner of every system in scope
- 02The URLs, apps, servers or repositories in scope (and anything out of scope)
- 03A technical contact we can reach during testing
- 04Test accounts for each user role, if the system has logins
An audit reviews configuration, code paths and settings broadly. A penetration test actively tries to break in to prove impact. Many teams start with an audit.
No. We use safe techniques, agree testing windows with you, and never run destructive or denial-of-service tests.
Never. Reports go only to the people you name, and we sign an NDA on request.