I don't know if my site is actually protected
We test against the OWASP Top 10 (the list of the most common web vulnerabilities) and show real findings with steps to reproduce them.
Find the holes in your website before an attacker does
We test your site, API and integrations the way an attacker would, with your written permission. You get a report: what we found, how to reproduce it and how to fix it. Your site, customer data and automations end up safer.
Quote and schedule after your brief
Who it's for
- Online store owners who take payments and store customer data
- Companies whose site connects to a CRM, an AI agent or a chatbot
- Teams about to launch a new site or a large ad campaign
- Businesses whose partners or clients ask for proof of security checks
Problems we solve
I'm afraid customer data could leak
We probe authentication, access rights and the API. We check specifically whether one user can see another user's orders or profile.
My last audit was an automated scan with no explanation
Scanners are only the starting point. We then test by hand and write the report in plain language, with priorities for your developer.
I don't know what to fix first
We rate every issue by risk (CVSS, a 0 to 10 scale) and give a fix order. After you patch, we retest.
What's included
- Scope agreement and signed permission to test
- Reconnaissance: which domains, subdomains, services and technologies are visible from outside
- Automated scanning (Burp Suite, OWASP ZAP, Nmap, nuclei)
- Manual testing of authentication, sessions and access control, including IDOR (reading other users' data by changing an ID)
- Injection and XSS checks on forms and API endpoints (XSS means running foreign code on your page)
- Server configuration, HTTPS, security headers and open ports review
- Search for leaked keys, tokens and credentials in code and responses
- Report with an executive summary for the owner and technical detail for the developer
- Walkthrough call to explain the findings
- Retest of fixes in the packages where it is listed
Choose the scope
Use a package to describe what you need. We agree on the quote and schedule after reviewing your brief and requirements.
01
Express audit
Landing page, brochure site or small store
- Automated scan plus manual check of the main risks
- Server setup, HTTPS, forms and admin panel
- Report with fix priorities
- Walkthrough call
02
Web app pentest
Online store, customer portal or service with user roles
- Grey-box test (with partial knowledge of the system) using accounts of several roles
- Authentication, sessions, access control and business logic
- API and integrations with your CRM and payment providers
- Detailed report with reproduction steps for each issue
- One retest after fixes
03
Extended audit
Product with several services, AI agents and its own infrastructure
- Everything in Web app pentest
- External infrastructure: servers, subdomains, cloud settings
- AI agents and chatbots checked for data leaks and unsafe commands
- 30-day remediation plan
- Two retests
How we work
Brief and requirements
You describe the task and current workflow. We clarify requirements, choose a first stage and prepare a quote.
Permission and access
We sign a written testing permission. You provide test accounts and, if possible, a staging environment.
Testing
We start with open-source reconnaissance and scanners. Then we test by hand what scanners cannot see.
Report and walkthrough
We deliver the report and explain every finding on a call. Critical issues are reported immediately, not at the end.
Retest
After your fixes, we check that the issues are closed. All files and materials stay with you.
Scope and limits
- We don't promise to find every vulnerability. A test shows the state on the test date, not permanent security.
- We don't test without the owner's written permission, and we don't attack third-party services such as your host or payment gateway.
- We don't run DDoS attacks or phish your staff unless that is agreed separately.
FAQ
How is a pentest different from a security audit?
A penetration test is a simulated attack, authorized by the owner, that proves a weakness can be exploited. An audit is wider and also reviews configuration and processes. Our packages combine both.
Can you test my live site?
Yes, but a staging copy is better. That way we don't touch real customers or orders. If there is no copy, we agree on a careful mode and a testing window.
What do I need to provide?
The site address, written permission, test accounts for different roles and a technical contact. Some cloud providers require notice before testing. We'll tell you what applies.
Do you fix the vulnerabilities yourselves?
The report gives your developer concrete recommendations. If you want, we can do the fixes as separate work, priced before it starts. We keep testing and fixing apart on purpose so the report stays independent.
Can I get a document to show a partner or client?
Yes. We can prepare a short summary for external use without technical details. It is not a formal certification. If you need one, an accredited body has to issue it.
How does payment work?
Payment terms are agreed with the quote before work starts. For a staged project, we describe the result and acceptance criteria for each stage. Support and third-party services are listed separately.
Start with your task
Describe your business, the outcome you need and your current workflow. We will clarify the requirements and prepare a quote after your brief.