— 01
You are launching a website or application with user accounts and personal data
Security
audit
for your website or app.
I find and fix security issues in websites and web applications. Start with external analysis or provide access for a review of your code, dependencies and infrastructure. After remediation, I retest the vulnerabilities found.
From review to remediation
External analysis
Code
Dependencies
Infrastructure
Choose your approach
2 review formats
Outcome
Remediation
01 — Who it is for
When to review your security
— 02
You have received a project from a contractor and want to review its code and access controls
— 03
Dependencies have not been updated for a while and you want to identify accumulated vulnerabilities
— 04
You need to check that users cannot access other users’ data or privileges
— 05
You have noticed suspicious requests, file changes or exposed technical information
— 06
You already have a vulnerability report and need a developer to fix and retest the findings
02 — What is included
A review from outside and inside the project
security review · remediation · retest
The review leads to practical fixes
The approach depends on access: external analysis reveals publicly reachable risks, while source and infrastructure access helps identify their causes. I verify findings manually, agree on remediation and repeat the affected scenarios after changes.
Website and API
PHP / Laravel
JavaScript / TypeScript
Composer / npm
Linux / Docker
Nginx
01
External website and API analysis
What I review
Public pages, forms, APIs and administrative interfaces: login, password recovery, access controls, input handling and file uploads. I check HTTPS, security headers, cookies and exposed internal files.
Without source access
A website address is enough to start. Private areas require test accounts with different roles. The report documents the scenarios covered and the limits of external analysis.
02
Code and business logic review
What I review
Authentication, sessions, roles, permissions, user data isolation, input validation, file handling and outgoing requests. I look for unsafe database queries, unescaped user input, missing authorization checks and secrets in code.
How I fix issues
I address the cause in the code, add checks for affected scenarios and verify that normal user actions still work. Changes are delivered through your project repository.
03
Dependency review
What I review
Framework versions, direct and transitive Composer and npm dependencies, lock files and known package vulnerabilities. I check whether a finding affects your installed version and application scenarios.
How I fix issues
I update or replace vulnerable dependencies, check compatibility and verify key project functions. If an upgrade needs additional development, we agree on that scope first.
04
Infrastructure and secrets review
What I review
Web server, environment and container configuration, permissions, exposed services, debug mode and access to databases and backups. I review secret storage, CI/CD permissions and sensitive data in logs.
How I fix issues
I restrict unnecessary access, correct configuration and permissions, and help rotate exposed keys and configure logging. Production changes are planned with backups and a rollback option.
05
Risk assessment and remediation plan
What you receive
Each confirmed issue has a description, affected component, reproduction conditions, consequences and remediation approach. Priority reflects how reachable the vulnerability is and its risk to data and business operations.
How we agree on scope
Critical findings are discussed immediately. We then agree on fixes, timeline and cost. Choose the full cycle or a review with tasks handed to your own team.
06
Remediation and retesting
After the review
I implement agreed changes in code, dependencies and configuration. I repeat the scenarios that revealed vulnerabilities and verify related application functions.
Documenting the outcome
You receive the changes and a final status list: what was fixed, what was retested and which risks remain and why. Further security recommendations are specific to your project.
03 — How we work
From an agreed scope to verified fixes
Define the task
We agree on addresses, environments, access and review scenarios. Choose external analysis or a review with code and infrastructure access, then confirm the terms.
Find vulnerabilities
I review the agreed components, validate findings and assess their impact. Critical risks are reported immediately, followed by a remediation plan.
Fix the issues
Once scope and cost are agreed, I change code, update dependencies and adjust configuration. Changes include checks and a release plan.
Verify the outcome
I repeat affected scenarios and verify key functions. You receive changes, a report on vulnerability status and recommendations for ongoing maintenance.
04 — Outcome
What you receive
Identified risks —
under control
You receive a clear report, agreed fixes and retest results. Outstanding issues come with a list of remaining risks and next steps.
Verified findings with priorities
Where each issue is, when it occurs and what it can affect.
Code and configuration changes
Remediation within the agreed scope, with descriptions and checks.
Retest results and remaining risks
A clear status for every finding and recommendations for further work.
Ready to review and improve your project’s security?
Send your website address or describe your application and available source code. I will propose a review approach; remediation scope, timeline and cost are agreed after assessing the findings.
external analysis or a review with access
first call is free
05 — Questions and answers
About security audits and remediation
How is this different from a technical audit?
A technical audit provides an overall assessment of architecture, code quality, performance and other project aspects. A security audit focuses on website or application vulnerabilities and can include remediation followed by retesting.
Can we start without code access?
Do you fix the vulnerabilities you find?
How do you review a production website?
How much does an audit cost and how long does it take?
Does an audit guarantee complete security?
06 — Other services
Further work on your project
from the service catalog
view all →
view all →