We find the weak spots in your systems before someone else does
Penetration tests of web applications, APIs and mobile apps, security audits of websites and online shops, code review. Quoted on scope, with a report your developers can act on and a summary the owner can read.
Most breaches do not start with a clever attack
They start with an outdated plugin, a forgotten test account, an API that returns someone else's data if you change one number in the address, or an admin panel with no second factor. The owner finds out when customers start calling. A penetration test is a controlled attack with your permission: we look at the system the way an attacker would, and tell you what we found, how dangerous it is and how to fix it. No scary words and no 200-page scanner printout.
Financial and crypto systems, where the bar is highest
We have also worked on other projects that we do not list publicly.
altcoins.bg
We found a vulnerability in the platform, reported it responsibly and it was fixed. We publish this with the permission of altcoins.bg; the details remain confidential.
Private bug bounty programmes
We take part in private bug bounty programmes run by financial institutions. Their terms are confidential, so we do not name the companies or describe the findings.
Responsible disclosure
Every finding goes only to the owner's security team, within the rules of the programme, and is never published without permission.
Six kinds of test
Web application penetration test
Manual testing against the OWASP Top 10 and beyond: login and sessions, access rights, injections, file uploads, business logic. We look for what scanners miss.
APIs and mobile apps
REST and GraphQL APIs, iOS and Android apps: authentication, access to other users' data, information leaks, rate limits.
Website and online shop audit
WordPress, WooCommerce, Shopify and other platforms: outdated plugins, weak passwords, exposed admin panels, wrong permissions, payments and customer data.
Code review
We read the application code and look for vulnerabilities at their source. Useful before launching a new product or after a major change.
Servers, cloud and email
Configuration of servers and cloud services, open ports, SSL, DNS, SPF, DKIM and DMARC, so nobody can send email in your name.
Bug bounty and disclosure
We help you set up a vulnerability disclosure programme: rules, scope, security.txt and a response process, so you are the first to hear about a problem.
Four steps, each with a clear result
Scope and permission
We agree which systems, which environment and in what timescale. We sign a contract with written permission and, where needed, a non-disclosure agreement.
Testing
Manual work, supported by tools. We agree the testing windows so we do not get in your customers' way, and we stop at once if we find something critical.
Report
Every vulnerability with a risk level, proof, steps to reproduce and a specific fix. Plus a short summary in plain English for the owner or the board.
Re-test
Once your team or we have fixed the problems, we check again and confirm in the report what is closed.
Quoted on scope, before we start
No two tests are alike, so we do not print a price. After a short call we send you a quote with a clear figure and timescale, and nothing starts until you approve it.
- How many systems, domains, APIs or apps are in scope
- Type of test: from outside with no information, with a user account, or with access to the code
- How many roles and user levels the application has
- Test or live environment, and the hours in which testing is allowed
- Timescale, and whether you need a re-test after the fixes
How we work
Only with permission
We test only systems for which the owner has given us written permission, and only within the agreed scope.
Confidentiality
What we find stays between us and you. We do not publish vulnerabilities or show reports without your consent.
No needless panic
We rank problems by real risk. Anything critical you hear at once, by phone, not at the end of the test.
Is your website on our care plan? The basics are already covered: updates, backups, a protected login and monitoring. A penetration test is the next step once you have an application, payments or a lot of customer data.
Cybersecurity questions
How much does a penetration test cost?
Every test is quoted on scope: the number of systems, type of test, roles, environment and timescale. After a short call to define the scope we send you a quote with a clear price and timescale before we start. We do not add UK VAT.
How long does a test take?
A small company website or shop takes a few working days. A web application with an API and several user roles usually takes from one to several weeks. The exact timescale is in the quote.
Will our website go down during the test?
It should not. Tests that could put load on the system are run in an agreed window or in a test environment. We do not run denial-of-service attacks unless you explicitly ask for them and we agree on it in writing.
Do you test without the owner's permission?
No. We work only on systems for which we have written permission from the owner, with a clearly defined scope. Bug bounty programmes are a public permission with their own rules, and we follow them strictly.
Do you sign a non-disclosure agreement?
Yes. Everything we see during the test stays between us and you. The report goes only to the people you name.
Do you also fix the problems you find?
Yes, if you want us to. We can fix the vulnerabilities ourselves, especially on WordPress and on sites we maintain, or hand the report to your developers and then verify their fixes.
What is bug bounty?
A programme in which a company allows outside researchers to look for vulnerabilities in its systems under defined rules and rewards valid reports. We take part in such programmes and can help you set up your own.
Tell us what to check
Send the address of the system and a phone number. We call, agree the scope and send you a quote with a price and timescale within 24 hours, no obligation. Or call 07440 590606, Mon to Sat, 8am to 7pm.