Security audit: Close the holes before the breach.
A security audit against the OWASP Top 10: we find vulnerabilities, score them with CVSS 3.1 and drive critical findings to zero across four rounds. Every finding comes with reproduction steps and a specific fix. A written report that stays on the point, without padding.
Where it usually hurts
No one has checked the security
The site or service has run for years, yet no one knows how well it's protected. It usually comes out after a leak or a customer complaint.
Customer data in the database
Phone numbers, addresses and orders sit in your system. If outsiders take them, you'll have to answer to customers and to the regulator.
Scanner reports go unread
An automated check produced hundreds of lines of output. Developers can't tell what's actually dangerous, so the review gets put off.
Fixed, but never rechecked
The developer says the vulnerability is closed, but no one verifies it. The flaw stays or reappears nearby, and it's found out too late.
What the business gains
Zero critical
We drive critical vulnerabilities to zero over four rounds: we find, you (or we) fix, we re-check. Findings get closed, not just listed.
The full OWASP Top 10
A pass across all 10 categories of OWASP 2021: auth, access control, secrets, configuration, injection. Every category is checked by hand, nothing skipped.
Findings with fixes
Every vulnerability comes with CVSS 3.1, a CWE ID, reproduction steps and a specific way to fix it. A developer follows instructions instead of guessing.
No contractor lock-in
The report and the fixes are yours. Fix with your team or ours — the data and code stay with you, inside Russia, under 152-FZ.
A tight, substantive read: what we found, how dangerous it is, how to reproduce it and how to fix it — with a re-check after the fixes land.
OWASP Top 10 — a full pass
We work through all 10 categories of OWASP 2021: access control, cryptography, injection, insecure configuration, vulnerable components, SSRF. Every finding is recorded and classified.
- All 10 OWASP 2021 categories checked
- Auth, access control (IDOR), session management
- Secrets, configuration, headers, TLS
- Vulnerable dependencies and components
Classification and priorities
Every finding carries a severity score and reproduction steps. We draw a clear line between what must be fixed before release and what can wait.
- Severity by CVSS 3.1
- A CWE ID for every finding
- Reproduction steps: 1-2-3
- Priorities: critical now / later
Fixes and four rounds
The audit doesn't end with a report. You (or we) fix, we re-check — and repeat until critical findings hit zero. Four rounds is usually enough.
- A specific fix for every finding
- Re-check after your fixes
- Up to 4 rounds included in the price
- Coordinated emergency fixes when something is critical
Data-protection law and storage
We check more than the code: the compliance basics too — consents, data residency, audit logs. Anything critical before a regulator's inspection is called out separately.
- A 152-FZ checklist for your stack
- Data residency (storage inside Russia)
- Consent capture at every collection point
- A remediation roadmap with hour estimates
From brief to launch
- Day 0NDA, read-only access, scope agreedauditor
- Days 1–3OWASP Top 10 pass, findings recordedauditor
- Days 4–5Report: CVSS, reproduction, fixes, compliance, roadmapauditor
- Rounds 2–3Re-check after your fixesauditor
- Round 4Final pass — the goal is zero criticalauditor
- + 14 daysAnswers to questions about the reportincluded
Pick the scope
A mid-complexity web application. OWASP Top 10, report, one re-check.
- OWASP Top 10 pass
- Findings with CVSS 3.1 + reproduction steps
- 1 re-check round
- Data-law checklist
- Active pentest — not included
- Deep API + mobile — not included
OWASP Top 10 + API + configuration + 4 rounds to zero critical.
- Everything in Express
- API: auth / IDOR / rate-limit / CORS
- Headers, TLS, secrets — in depth
- Up to 4 re-check rounds
- Compliance checklist + roadmap
- Coordinated emergency fixes
Code audit plus an active pentest: both the analysis and a real attempt to break in.
- Full OWASP audit
- Active pentest (web + API)
- Exploitation of what's found
- Video walkthrough of critical findings
- Extended re-testing
- Help with the regulator notification
Package prices are in the price list. We put an exact number on it after a free review of the task.
Price PDF