Service
Web and application security
We find the weak points in your website and web apps, fix what we can, and explain the rest in plain language you can act on.
Who it is for
- Business owners who want to know whether their website is a liability, without a 90-page scanner report.
- Startups preparing for a customer security review, a questionnaire, or their first enterprise deal.
- Teams that have shipped fast and now want someone to check the basics before something goes wrong.
Problems we solve
- You do not know whether your site, plugins, or admin panels are exposed.
- A customer or partner sent a security questionnaire and you are not sure how to answer it.
- Bots are hammering your login, forms, or checkout.
- Secrets live in code, shared documents, or old employees' inboxes.
- Previous security reports were too technical to act on.
What is included
Website security audit
A structured review of your site, hosting, DNS, and third-party scripts, prioritized by real-world risk.
Security headers and TLS hardening
Content Security Policy, HSTS, modern TLS settings, and the other headers that close common attack paths.
Web application vulnerability assessment
Manual and tool-assisted testing against the OWASP Top 10, including access control, injection, and authentication flaws.
Cloudflare WAF and bot protection
Managed rules, rate limiting, Turnstile on forms, and custom rules tuned to your traffic.
Email authentication
SPF, DKIM, and DMARC set up and monitored, so attackers cannot easily send mail as your domain.
Access control and secrets hygiene
Least-privilege access, multi-factor authentication, removing stale accounts, and moving secrets into a proper store.
Reports written for owners
A short summary of what matters and why, plus a technical appendix for whoever fixes it.
Ongoing security monitoring
Scheduled re-checks of headers, certificates, DNS, exposed services, and dependencies, with alerts when something changes.
Authorized testing only. We only test systems you own or are authorized to test, and only with written permission that defines the scope. We do not test third-party systems on your behalf without their owner's consent.
What you get
- A plain-language summary ranked by risk, with clear next steps.
- A technical findings appendix with evidence and reproduction steps.
- Fixes applied directly where you want us to, or tickets your developers can pick up.
- A re-test after fixes, so you know the issues are closed.
How the engagement works
Discover
We agree on scope and confirm what you own, and you give written authorization before any testing.
Plan
A test plan with targets, timing, methods, and contacts in case something urgent is found.
Secure
We test, report, and help fix, starting with the highest-risk issues.
Support
Optional re-tests and ongoing monitoring.
FAQ
Frequently asked questions
Is this a penetration test?
A vulnerability assessment of a web app includes the hands-on testing most people mean by a penetration test, scoped to the systems you authorize. We will tell you plainly if your situation calls for a larger, formal engagement.
Will testing take my site down?
We agree on timing and methods first and avoid destructive or high-volume tests on production unless you ask for them. If we find something urgent, we stop and tell you straight away.
What do you need from us to start?
A short scoping call, confirmation of which domains and apps are in scope, written permission from someone authorized to give it, and a contact for urgent findings.
Can you help answer a customer's security questionnaire?
Yes. We can help you understand the questions, close the gaps that matter, and describe your controls accurately. We will not help you claim controls you do not have.
Related work and reading
Products we run
- blueteamjobs.com: A job board for defensive cybersecurity (blue team) roles.
Other services
Ready to talk about Security?
Tell us what you are working on. You will hear back from the person who would actually do the work.