Is this a penetration test?

No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.

Will the audit affect production?

No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.

What if you find an active exploit?

We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.

Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.

Can you remediate the findings?

Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Website Audits

Website-Sicherheitsprüfung

Website-Sicherheitsprüfung. Konfigurationsüberprüfung, Schwachstellenscan, Überprüfung der Drittanbieterintegration, priorisierte Behebung.

Turnaround: 5 working days
Mode: Read-only
Walkthrough: 60 minutes
Scoring: Severity + exploitability

Overview

What it is.

Sicherheitsprüfung für E-Commerce-Shops. Wir überprüfen die Konfiguration, scannen nach bekannten Schwachstellen, prüfen die Anmeldedaten von Drittanbietern und untersuchen die gängigen Muster, die zu Sicherheitsverletzungen führen. Nur Leserechte in der Produktion. Das Ergebnis ist eine priorisierte Liste von Behebungsmaßnahmen mit Schweregrad, Ausnutzbarkeit und Aufwand. Die meisten Prüfungen dauern 5 Arbeitstage. Shops mit aktiven Vorfällen oder bekannten vorherigen Sicherheitsverletzungen erhalten eine gezielte Untersuchung als separate Maßnahme.

What you get

Deliverables.

Configuration review (admin URL, 2FA, session config, file permissions)
Patch-gap analysis (CVEs vs current install)
Third-party integration credential audit
Content Security Policy review
Outbound traffic and webhook audit
Admin user role and access review
Prioritised remediation list (severity + exploitability + effort)
60-minute walkthrough call

Honest limits

What it isn't.

Not a penetration test; pentests are a separate engagement
Active incident response is a separate engagement
Custom-application vulnerability fuzzing is out of scope

Not sure if it's a fit? Email us. We'll tell you straight.

How it works

From inquiry to handover.

01
1. Brief
Read-only access provided. NDA in place. Scope of integrations confirmed.
02
2. Audit
Configuration, CVE-gap, credentials and policy review. Findings catalogued with severity.
03
3. Report + walkthrough
Written report and 60-minute walkthrough with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

Is this a penetration test?: No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.
Will the audit affect production?: No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.
What if you find an active exploit?: We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.
Do you sign NDAs?: Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.
Can you remediate the findings?: Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services

Website Audits

Website-Sicherheitsprüfung

Website-Sicherheitsprüfung. Konfigurationsüberprüfung, Schwachstellenscan, Überprüfung der Drittanbieterintegration, priorisierte Behebung.

Turnaround: 5 working days
Mode: Read-only
Walkthrough: 60 minutes
Scoring: Severity + exploitability

Overview

What it is.

What you get

Deliverables.

Configuration review (admin URL, 2FA, session config, file permissions)
Patch-gap analysis (CVEs vs current install)
Third-party integration credential audit
Content Security Policy review
Outbound traffic and webhook audit
Admin user role and access review
Prioritised remediation list (severity + exploitability + effort)
60-minute walkthrough call

Honest limits

What it isn't.

Not a penetration test; pentests are a separate engagement
Active incident response is a separate engagement
Custom-application vulnerability fuzzing is out of scope

Not sure if it's a fit? Email us. We'll tell you straight.

How it works

From inquiry to handover.

01
1. Brief
Read-only access provided. NDA in place. Scope of integrations confirmed.
02
2. Audit
Configuration, CVE-gap, credentials and policy review. Findings catalogued with severity.
03
3. Report + walkthrough
Written report and 60-minute walkthrough with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

Is this a penetration test?: No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.
Will the audit affect production?: No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.
What if you find an active exploit?: We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.
Do you sign NDAs?: Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.
Can you remediate the findings?: Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services

Website-Sicherheitsprüfung

What it is.

Deliverables.

What it isn't.

From inquiry to handover.

1. Brief

2. Audit

3. Report + walkthrough

Questions we get from people about to book.

Tell us about your project.

Website-Sicherheitsprüfung

What it is.

Deliverables.

What it isn't.

From inquiry to handover.

1. Brief

2. Audit

3. Report + walkthrough

Questions we get from people about to book.

Tell us about your project.