Security assessments
I test what an attacker on the internet can reach.Hosts, web apps, APIs and cloud.
You get a report that says what I found, how to reproduce it, how bad it is and how to fix it.
Authorization first
Testing starts only after you sign a written authorization and scope. See how an engagement works.
What I test
- 01
External attack surface review
What does the internet see of you? I map the hosts, services and applications that are reachable, including ones you may have forgotten: old staging sites, abandoned subdomains, exposed admin panels, forgotten files.
You get An inventory of what is exposed, what should not be, and what to close first.
- 02
Web app and API testing
I test your application as an outsider and as a normal signed-in user. Login and sessions, access control between accounts and between organizations, input handling, file handling, business logic, and the API behind the pages.
You get Confirmed findings with reproduction steps. A hidden button is not access control, so I check what the server actually allows.
- 03
Cloud exposure checks
Open storage buckets, public snapshots, leaked keys in front-end code, misconfigured DNS and subdomains that can be taken over, publicly reachable services that should be private.
You get A list of exposures with evidence and the setting or change that closes each one.
How I test
- Unauthenticated first: what anyone on the internet can reach and do.
- Then signed in, using ordinary test accounts created through your normal signup flow, or accounts you provide. Two accounts, so I can check whether one can reach the other's data.
- No source code or server credentials unless we agree on a different kind of test.
- Bounded proof. I show an issue exists with the least data needed. I do not pull unrelated data.
- Every test gets an outcome, including the ones that found nothing.
What is not covered
A web-only assessment says nothing about your internal network, your laptops or your staff. The report lists exactly what was and was not tested. No finding does not mean no vulnerabilities.
What the report contains
- Summary for management, in plain language.
- Scope, dates, and what was tested.
- Each finding: title, severity, confidence, what the server did, what it should have done, impact, steps to reproduce, evidence, recommended fix, and how I will retest it.
- A list of areas not tested or blocked, with the reason.
- Cleanup notes: test accounts and data I created.
After the report
You choose:
- Fix the findings with your own engineers. I answer questions.
- Hire me to fix them.
Either way, I retest the original findings and nearby areas, and send an updated report. Retest is included.