Web-app penetration testing
Black- and grey-box testing of your web application: authentication, business logic, injection and access-control flaws found and proven, with fixes ranked by real risk.
[ 02 · Break the machine ]
Security Testing
Find the way in. Close it before someone else opens it.
Discreet · by request
[ 01 ]The work
Every system leaves a tell.
The same instinct that names a thought on stage finds the exposure a system gave away without meaning to: the that trusts the wrong input, the subdomain nobody decommissioned, the a login form makes. I attack it the way a real attacker would, then hand you exactly what to close, in plain language. Quietly.
[ 02 ]Services
Three engagements.
API & authentication testing
Your APIs, sessions and access controls pushed the way an attacker would: broken object-level authorisation, token handling and privilege escalation, demonstrated end to end.
Remediation & retest
Findings written so the fix is obvious and prioritised by genuine impact. Then a retest once you've closed them, to prove the holes are gone.
[ 03 ]Non-negotiables
Three lines I don't cross.
Discretion
Nothing about an engagement is discussed, named or referenced anywhere. Whatever channel we agree for it is the only one it lives on.
Legality
Scoped, authorised and within the law, always. Written permission before a single packet. No exceptions, no grey areas.
Precision
Signal, not noise. Findings are reproducible, prioritised by genuine impact, and written so the fix is obvious.
[ 04 ]How an engagement runs
Four phases, fully on the record.
01
First contact
You send a short enquiry with no sensitive detail in it. We agree a channel that suits the engagement before any of that is shared.
02
Scope & authorisation
We agree targets, boundaries and timing in writing. Nothing happens outside the signed scope.
03
The work
Recon, testing and verification, documented as I go, with anything critical flagged to you in real time.
04
The handover
A clear report: what was found, why it matters, and the exact steps to close it. A retest when you've fixed it.
Something you'd rather find first.
Keep the detail out of this first message. We agree a channel for anything sensitive before any of it is shared.
Send a first enquiry No sensitive detail in this first message · reply same day