Application Security Review
Find the authorisation hole before somebody else does.
The vulnerabilities that actually hurt small applications are rarely exotic. They are a missing ownership check on an API route, a dependency two major versions behind a known advisory, a secret committed to git eighteen months ago, or an admin endpoint protected only by the fact that nobody has guessed the URL.
This review looks for exactly those. Authentication and session handling, authorisation on every state-changing operation, input validation, dependency advisories, secret exposure in git history, security headers and rate limiting.
You get a written report with each finding, a concrete reproduction, a severity rating and the specific fix.
What you get
Authentication and session review
Token handling, cookie flags, expiry, revocation.
Authorisation testing
Object-level ownership checks on every state-changing operation.
Dependency advisory scan
Production dependencies against known CVEs.
Secret exposure check
Including git history, not just the working tree.
Headers and rate limiting review
CSP, HSTS, and whether limits are shared across instances.
Report with reproductions and fixes
Each finding rated and actionable.
OWASP methodology · Dependency auditing · Manual testing
Questions about this
Is this a penetration test?
No. It is a code-and-configuration review by the developer who would fix it, which finds a different and often more relevant class of problem for an application this size. A formal pentest by a specialist firm is a separate exercise, and I will tell you if you need one.