Security audit

I find the vulnerabilities in your application or website, before an attacker does

Your application works, but is it protected?

You know what is risky, what to fix first, and how much it costs.

With Claude, ChatGPT, Lovable or WordPress, anyone can build an application or a website. These tools make sure it works. They think less about security.

The same vulnerabilities come up again and again. An API key visible in the page, which someone uses at your expense. A database anyone can read. As long as the application has few users, nothing happens. Once it starts making money, it attracts attackers.

I go over your whole application, and tell you what to fix

I start with the vulnerabilities found in almost all of these applications. Then I look at what is specific to yours: accounts, data, payments, AI.

You receive a simple report, from most urgent to least urgent. For each problem: the risk, and how to fix it. You can make the fixes with your AI, or leave them to me.

  • Applications built with AI, WordPress sites and servers
  • Poorly hidden API keys and passwords
  • Your customers’ data visible to anyone
  • Payments, accounts and admin access
  • An easy-to-read report, with the fixes to make

Pricing

Quote on request

The price depends on the size of your application. You know it before I start.

Discuss your project

What I check

The vulnerabilities found most often.

Keys and passwords

An API key (OpenAI, Claude, Stripe…) visible in the page: someone else uses it, and you pay.

Customer data

A database (Supabase, Firebase…) that anyone can read or modify.

Accounts and access

A customer who can see another customer’s data, or an admin page open to everyone.

Payments

A payment that can be bypassed to get the service without paying.

AI agents and tools

An AI agent with too many permissions, or one that a booby-trapped message can hijack.

Server and versions

Software that is out of date, or backups that do not exist.

How it works

1. You show me your application on a video call

2. I send you the quote and an authorisation to sign

3. I examine without changing anything

4. I hand over the report and we go through it together

5. If you like, I fix the vulnerabilities myself

Still have questions?

I answer all your questions.

  • Yes, that is what it is written for. Each problem is explained simply, with its consequences. You can even copy the fixes and give them to the AI that built your application.

  • Part of it is done without any access. To go further, I need to read the code and, if you have one, the database. I change nothing during the audit.

  • Testing a site’s security without its owner’s consent is against the law, even with good intentions. The authorisation states what I am allowed to check. It protects us both.

    If your site is with a hosting company, I tell you whether they need to be informed too.

  • Yes. We start with the emergency: stop the attack, clean the site, and close the hole the attacker came in through. Otherwise, they often come back a few weeks later.

    Then the audit checks that there is no other vulnerability.

  • Yes, when an audit is not enough. In a penetration test, I really try to get into your site, the way an attacker would. We agree in writing beforehand on what I can test and when.

    It is usually done on a copy of the site, so as not to disturb your customers.

  • You fix things yourself with your AI, or I take care of it. I can also come back and check after a major update to the application: that is often when new vulnerabilities appear.

Need more information?

Get in touch and I’ll answer all your questions.

Request a meeting
Close