Is this a penetration test?

No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.

Will the audit affect production?

No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.

What if you find an active exploit?

We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.

Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.

Can you remediate the findings?

Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Website Audits

Audit de Sécurité du Site Web

Audit de sécurité du site web. Revue de configuration, scan de vulnérabilités, vérification des intégrations tierces, remédiation priorisée.

Turnaround: 5 working days
Mode: Read-only
Walkthrough: 60 minutes
Scoring: Severity + exploitability

Overview

What it is.

Audit de sécurité pour les boutiques en ligne. Nous examinons la configuration, effectuons un scan des vulnérabilités connues, auditons les identifiants d'intégration tierce, et vérifions les schémas communs qui mènent à des violations. Accès en lecture seule sur la production. Le résultat est une liste de remédiation priorisée avec des scores de gravité, d'exploitabilité et d'effort. La plupart des audits prennent 5 jours ouvrables. Les boutiques avec des incidents actifs ou des violations antérieures connues bénéficient d'une enquête ciblée en tant qu'engagement séparé.

What you get

Deliverables.

Configuration review (admin URL, 2FA, session config, file permissions)
Patch-gap analysis (CVEs vs current install)
Third-party integration credential audit
Content Security Policy review
Outbound traffic and webhook audit
Admin user role and access review
Prioritised remediation list (severity + exploitability + effort)
60-minute walkthrough call

Honest limits

What it isn't.

Not a penetration test; pentests are a separate engagement
Active incident response is a separate engagement
Custom-application vulnerability fuzzing is out of scope

Not sure if it's a fit? Email us. We'll tell you straight.

How it works

From inquiry to handover.

01
1. Brief
Read-only access provided. NDA in place. Scope of integrations confirmed.
02
2. Audit
Configuration, CVE-gap, credentials and policy review. Findings catalogued with severity.
03
3. Report + walkthrough
Written report and 60-minute walkthrough with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

Is this a penetration test?: No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.
Will the audit affect production?: No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.
What if you find an active exploit?: We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.
Do you sign NDAs?: Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.
Can you remediate the findings?: Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services

Website Audits

Audit de Sécurité du Site Web

Audit de sécurité du site web. Revue de configuration, scan de vulnérabilités, vérification des intégrations tierces, remédiation priorisée.

Turnaround: 5 working days
Mode: Read-only
Walkthrough: 60 minutes
Scoring: Severity + exploitability

Overview

What it is.

What you get

Deliverables.

Configuration review (admin URL, 2FA, session config, file permissions)
Patch-gap analysis (CVEs vs current install)
Third-party integration credential audit
Content Security Policy review
Outbound traffic and webhook audit
Admin user role and access review
Prioritised remediation list (severity + exploitability + effort)
60-minute walkthrough call

Honest limits

What it isn't.

Not a penetration test; pentests are a separate engagement
Active incident response is a separate engagement
Custom-application vulnerability fuzzing is out of scope

Not sure if it's a fit? Email us. We'll tell you straight.

How it works

From inquiry to handover.

01
1. Brief
Read-only access provided. NDA in place. Scope of integrations confirmed.
02
2. Audit
Configuration, CVE-gap, credentials and policy review. Findings catalogued with severity.
03
3. Report + walkthrough
Written report and 60-minute walkthrough with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

Is this a penetration test?: No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.
Will the audit affect production?: No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.
What if you find an active exploit?: We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.
Do you sign NDAs?: Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.
Can you remediate the findings?: Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services

Audit de Sécurité du Site Web

What it is.

Deliverables.

What it isn't.

From inquiry to handover.

1. Brief

2. Audit

3. Report + walkthrough

Questions we get from people about to book.

Tell us about your project.

Audit de Sécurité du Site Web

What it is.

Deliverables.

What it isn't.

From inquiry to handover.

1. Brief

2. Audit

3. Report + walkthrough

Questions we get from people about to book.

Tell us about your project.