Cybersecurity for your site, your code and your servers

The challenge

An application can work well for its users and still let someone read other people’s data by changing a number in the address, inject code through a form or reach a dashboard without the right session. Those flaws do not show up in normal use: they appear when someone looks for them.

How we do it

• Surface map: An inventory of the pages, forms, API endpoints and user roles in scope.
• Injection and XSS: Tests on every data input to detect SQL or command injection and scripts that run in other users’ browsers.
• Access control and authentication: We check that each user only sees and changes their own data, and review sessions, password recovery and attempt limits.
• Exposed data: We look for API responses that return more than needed, errors that reveal internal details and files published by mistake.
• Headers and CSP: We review HTTPS, HSTS, cookies and Content Security Policy, and propose a configuration that keeps the site working.

What you get

A report with every finding ordered by risk, the evidence to reproduce it and the recommended fix, and a new test of each point once it is fixed.

The challenge

Many leaks start in the repository, not on the server: a key written into the code, a config file committed by mistake or a library with a published vulnerability nobody updated. Every dependency is third-party code running with the same permissions as yours.

How we do it

• Secrets in the history: We search for keys, tokens and passwords in the code and in the Git history, not just the current version.
• Dependencies with CVEs: We match the project libraries against published vulnerabilities and prioritize the ones actually in use.
• Supply chain: We review lockfiles, pinned versions, install scripts and poorly maintained packages, and recommend pnpm with frozen installs.
• Static review: Analysis of the code for dangerous patterns: hand-built queries, missing validation and excess permissions.
• Debt that creates risk: We flag unsupported framework versions and shortcuts that work today but open a door tomorrow.

What you get

A report with the secrets to rotate, the dependencies to update or replace and the recommended code changes, with every fix reviewable in the repository.

The challenge

A freshly created server ships with defaults meant to make it work, not to make it hold up. Open ports, password SSH access and services running as root are the first things the bots crawling the internet try, all the time.

How we do it

• Firewall and ports: Only the ports the service needs stay open; the rest are closed or limited to known addresses.
• SSH: Key-only access, no root or password login, and automatic blocking of brute-force attempts.
• Docker and Nginx: Unprivileged containers, pinned images and an Nginx with security headers, request limits and only what is needed exposed.
• TLS: Auto-renewing certificates, current protocols and ciphers, and all traffic redirected to HTTPS.
• Backups and monitoring: Backups stored away from the server, a tested restore and alerts when the service goes down or something changes.

What you get

A server with documented configuration, access in your name and a checklist to repeat the hardening on every new server.

The challenge

A compromised WordPress site is not always obvious: it may redirect only visitors coming from a search engine, create hidden administrators or hide a backdoor that reinstalls the malware after every cleanup. On a WooCommerce store, your customers’ data is also at stake.

How we do it

• Backup and containment: Before touching anything we save a copy of the current state and cut off the attacker’s access.
• Scan and cleanup: We compare the core, plugins and themes with their official versions and remove backdoors, injected files and malicious code in the database.
• Plugins and themes: We remove the compromised, abandoned or unofficially sourced ones, and update the rest.
• Users and credentials: We delete accounts nobody recognizes and rotate passwords, database credentials and WordPress secret keys.
• Recovery and hardening: We request a review of the site if it was flagged as dangerous, and harden permissions, login and updates to reduce the risk of it happening again.

What you get

A clean site back online, a report of what was found and how the attacker got in when that can be determined, and the option to continue with a monthly maintenance plan.