How Our Security Audit Works

Testing is performed only within a written authorisation that names the systems, the permitted techniques, the testing window and the contacts on both sides, and nothing outside that scope is touched. Assessment covers the application, its configuration and its infrastructure: authentication and session handling, access control between accounts and roles, injection paths including SQL and command contexts, cross-site scripting and request forgery, insecure direct object references, file upload handling, and the security-relevant HTTP response headers. Dependencies are inventoried and checked against known vulnerabilities by exact version rather than by name. Server configuration review covers exposed services, permissions, and whether error output leaks internal detail. Every finding is reported with the evidence that produced it, the conditions required to reproduce it, and a severity that reflects real exploitability in this environment rather than a generic score. Findings that could not be confirmed are labelled unverified rather than reported as fact. Remediation guidance is specific, and a retest confirms each fix.