Risk-based testing. Evidence-driven security.
We match the depth of testing and security work to each project's risk. We report what we tested and what we found — and we never claim complete security, certifications, penetration testing or compliance without evidence.
How we test
A layered approach, applied proportionally to each project.
Functional
Each feature behaves according to its requirements.
Integration
Components and services work correctly together.
API
Endpoints return correct responses, status codes and errors.
Database
Queries, migrations and data integrity behave as expected.
Regression
New changes do not break previously working behaviour.
Cross-browser
Consistent behaviour across major browsers.
Responsive
Layouts adapt across desktop, tablet and mobile.
Accessibility
Keyboard, contrast and semantics checked against WCAG guidance.
Performance
Load times, responsiveness and resource usage are measured.
Security
Risk-based checks against common vulnerability classes.
Security we take seriously
We review applicable OWASP risks and apply secure defaults. The specific controls depend on what the system handles and who can access it.
OWASP risk awareness
We review applicable items from the OWASP Top 10 based on each project's risk.
Authorization
Access is checked on the server for every protected action, not just hidden in the UI.
Tenant isolation
In multi-tenant systems, data is scoped so one tenant cannot reach another's data.
SQL injection
Parameterized queries and safe data access patterns by default.
XSS
Output encoding and framework protections against cross-site scripting.
CSRF
Token-based protection for state-changing requests where applicable.
Rate limiting
Throttling sensitive endpoints to reduce abuse and brute force.
Dependency scanning
Monitoring and updating dependencies with known vulnerabilities.
Secrets management
Secrets kept out of source control and out of frontend code.
Secure configuration
Hardened defaults, least privilege and safe headers.
Logging
Meaningful logs for diagnostics without exposing sensitive data.
Backup & restore
Backups are taken and restore procedures are validated, not assumed.
What we will and won't claim
We will
- Describe what we tested and the results.
- Review against applicable OWASP risks.
- Apply secure defaults and least privilege.
- Validate backups by actually restoring them.
We won't
- Claim software is “completely secure”.
- Imply certifications we don't hold.
- Claim penetration testing we didn't perform.
- Assert compliance without evidence.
Need a security-conscious build?
Tell us what your system handles and we'll propose a testing and security approach matched to the risk.