Find the security holes before someone else does
We review your website, app or API code for weaknesses an attacker could use, and show you exactly how to close each one.
In plain English.
Most security checks look at the outside of a website, such as whether the padlock shows, the headers are set and the plugins are current. That is useful, but the serious problems usually sit inside the code. A login can be skipped, a customer can see another customer's orders by changing a number in the address bar, or an upload form accepts a script.
A security audit reads the code itself. We map where your system trusts people and data, then check each of those points in turn. That covers sign-in and permissions, file uploads and forms, payment webhooks, the packages your code depends on, how it is deployed, and any AI features that read customer content. Every possible problem is checked before it goes in the report.
Nothing is tested against your live site or any customer data. Where a finding needs proving, we reproduce it safely on an isolated copy. You get a plain-English report that ranks each issue by how much harm it could do, with the evidence and the smallest change that fixes it.
It suits you if.
- You have a custom website, app, portal or API that handles logins or payments
- You are about to launch, or a bigger customer is asking how secure your software is
- A developer built your system and you have no way to judge how safe it is
- You run WordPress or WooCommerce with custom plugins or theme code
- You have added AI features that read emails, documents or customer messages
What we do.
Access and permissions
We check that every page and API route confirms who is asking and what they are allowed to see, so one customer cannot reach another customer's records.
Forms and file uploads
Anything a visitor can type or upload is traced through the code to see whether it can run commands, alter database queries or plant scripts in pages other people view.
Payments and webhooks
We check that payment callbacks and webhooks are verified and cannot be faked or replayed, and that API keys for Stripe, Xero or similar services are kept out of reach.
Dependencies and deployment
Third-party packages and plugins are checked for known flaws, and build settings for risky defaults. We also look at how secrets and hosting environments are configured.
AI features
Chatbots and AI tools that read outside content are checked for prompt injection, where hidden instructions in an email or web page could make the AI leak data or take actions.
Findings with evidence
Each issue in the report names what is affected, how it could be used and the evidence from your code. Theoretical worries that would do no harm in practice are left out.
How it runs.
- 01
Free 15-minute call
Tell us what the system does, who uses it and what worries you. We agree the scope and a fixed price before you share any code.
- 02
Read the code
You give us read access to the code. We map the entry points and trust boundaries, then review each one in depth.
- 03
Prove and rank
Possible problems are confirmed safely on an isolated copy, never on your live site, then ranked by the harm they could cause.
- 04
Report and fix
You get the report and a walkthrough call. We can make the fixes ourselves or brief your developer, then check them again.
Questions people ask.
Is this the same as a penetration test?
Not quite. A penetration test attacks your live system from the outside. A security audit reads the code from the inside, which finds problems an outside test often misses. Where a contract or insurer asks specifically for an accredited penetration test, we can point you to a CREST-accredited tester.
Will it affect my live website or customers?
No. We work from a copy of your code and never send test attacks to your live site or touch customer data. Anything that needs proving is reproduced on an isolated copy with made-up accounts.
What do you need from me?
Read access to the code, usually through GitHub or a zip file, plus a short description of who uses the system and what it does. Any test logins we need are created on a copy, not on your live system.
How much does it cost and how long does it take?
A small website or WordPress plugin can be reviewed in a few days, while a larger app or portal takes longer. The price follows the size of the codebase, and it is fixed and agreed on the free call, before any work starts.
Your next chapter starts with a conversation.
Nottingham & Derby / UK-wideLet’s build
what’s next.
15 minutes with Garreth.
A real conversation about your business.