Independent security testing
I find the ways into your systemsbefore someone else does.
Security assessments of your external attack surface, web apps, APIs and cloud setup. You get a written report. Fix it with your own engineers or hire me to fix it. Retest is included.
External security assessment
Example Co
Findings and retest
| ID | Finding | Severity | Retest |
|---|---|---|---|
| F-001 | Customer invoices readable across accounts | High | Fixed |
| F-002 | Staging site exposed and indexed | Medium | Not fixed |
| F-003 | Admin panel reachable from the internet | Medium | Could not verify |
| F-004 | Missing security headers | Low | Open |
| F-005 | Outdated JavaScript library | Low | Open |
| F-006 | security.txt missing | Info | Open |
Authorization first
I only test systems after you sign a written authorization and scope.No signed scope, no testing.
What I do
Security assessments
External attack surface review, web app and API testing, cloud exposure checks. A report with evidence, impact and a fix for each finding, then a retest.
Build
Websites, web apps, mobile apps, hosting and care plans. Built by someone who tests security for a living.
Research
Write-ups of real security events and plain explainers on common website problems.
How an engagement works
- 01
Talk and scope
- 02
Written authorization and rules
- 03
Testing
- 04
Report
- 05
Fix, by you or by me
- 06
Retest
What you get
- A report your engineers can act on: steps to reproduce, evidence, impact, a recommended fix.
- A list of what was tested and what was not.
- A retest that confirms each fix.