What we do

Security audits for everything your business exposes online

We focus on offensive security, from the web to the infrastructure: we simulate what an attacker would do, but in a controlled way and with your authorisation.

Web applications and e-commerce

A full review of your application the way an external attacker would approach it and, if agreed, as an authenticated user with different roles.

Who it is for: online shops, customer portals, booking platforms, custom applications.

What we review

Authentication, password recovery and session management
Access control and permissions between users
Injection (SQL, command, template) and XSS
Business logic, carts, discounts and payments
File uploads and server configuration

APIs

Analysis of the REST and GraphQL APIs used by your website, mobile app or partners.

Who it is for: companies with a mobile app, third-party integrations or a microservices architecture.

What we review

Object-level and function-level authorisation
Excessive data exposure
Rate limits and endpoint abuse
Token and key management

WordPress and other CMS

A review of the installation, configuration and the third-party components that are most exploited in practice.

Who it is for: corporate websites, blogs, WooCommerce shops and agency-managed sites.

What we review

Core, plugin and theme versions with known vulnerabilities
Users, roles and weak passwords
Exposed files and admin panels
Configuration hardening

Exposed infrastructure

A map of what your company has visible from the internet and an assessment of its configuration.

Who it is for: companies with their own servers, VPS or publicly reachable cloud services.

What we review

Unnecessary open ports and services
TLS certificates and encryption
HTTP security headers
Admin panels and forgotten services

Infrastructure pentest

A full penetration test of servers and networks: we start from what an attacker can see and check how far they could get, keeping the risk under control.

Who it is for: companies with their own servers, a corporate network, a Windows domain or critical services that want to know their real exposure.

Service under a specific agreement: exploitation and escalation are only carried out with express authorisation for them.

What we do

Reconnaissance and port and service scanning
Vulnerability identification and validation
Controlled exploitation and initial access
Privilege escalation to administrator or root
Active Directory and lateral movement, if included in the scope
Evidence of the real impact and remediation advice

Fix re-test

Once the findings have been fixed, we check again that the measures work and have not introduced new problems.

What you receive

Status of each finding: fixed, partially fixed or open
An updated closing report

Scope

What we do not do

Setting the limits from the start protects everyone.

We do not test anything without the owner's written authorisation.
We do not run denial-of-service or stress tests unless expressly agreed.
We do not run social engineering against your team unless specifically agreed.
We do not modify or delete production data. In an infrastructure pentest we demonstrate access without leaving persistent changes and revert whatever is needed.
We do not issue certifications (ISO 27001, ENS or others): a technical audit is not a certification.

For web agencies

If you build websites for clients, we can audit your deliverables before they go live. Write to us and we will prepare an arrangement that fits the way you work.

Talk to us

Which part of your website worries you most?

Tell us and we will propose the right scope.

Request an audit