Technical & security audit

Our product works, but we don't know whether its technical foundations are safe enough: what are the main risks to fix first?

1,800 € excl. VAT - Timeline: 8 to 12 working days

A product can work perfectly while carrying risky configurations, exposed data or vulnerable dependencies. Working from the source code and the access you give us, we examine a scope of up to 10 pages or screens: APIs, database, secrets and environment variables, authentication and permissions, hosting, dependencies. We combine automated tools with manual checks, then assess the priority of each identified risk and hand you concrete recommendations. This is not a pentest: we don't claim to be exhaustive, we give you a clear view of the main visible risks and the order in which to address them.

For example, Your product was built quickly and you want to check its robustness before opening it up further, You use several external services and want to make sure no sensitive data is exposed, You built a web app with AI or low-code tools and want the main risks checked...

What's included

  • Source code review and identification of risky configurations
  • Review of APIs and database
  • Review of secrets and environment variables
  • Check of authentication, permissions and access
  • Review of hosting and dependencies
  • Automated analysis complemented by manual checks
  • Identification of the main visible risks and bad practices
  • Prioritised recommendations
  • Scope of 10 pages or screens maximum

What's not included

  • Full pentest
  • Guarantee of absence of vulnerabilities
  • Regulatory, legal or GDPR compliance audit
  • Security certification
  • Fixing the identified issues
  • Exhaustive infrastructure audit
  • Analysis beyond 10 pages or screens

Prerequisites

  • Access to the product
  • Access to the source code
  • Access to a test environment if needed

Frequently asked questions

Is this a pentest?

No. A pentest tries to exploit flaws exhaustively. Here, we identify the main visible risks in the code, configuration and access, and we prioritise them. What we report is not exhaustive, and we would rather say so.

What exactly do you look at?

The code, APIs, database, secrets and environment variables, authentication and permissions, hosting and dependencies, using automated tools and manual checks.

Do you fix the issues you find?

No, the audit identifies and prioritises. Fixes are out of scope. If you want to go as far as a remediation plan with your team, the Advanced technical & security audit is designed for that.

How long does it take?

We agree on a start date with you after purchase, depending on our respective availability. On average, this engagement takes between 8 and 12 working days once started.