12 / Services
A security check
We look for gaps in access and in data sync, close what is critical, and leave rules, not a one-off report.
For products that already take outside data, or are about to let an external client in.
Access
Roles
Client
Staff member
Admin
Order
File
Payout
Sign-in
Role
Other
Closed
Risk
List
What it consists of
What goes into the system
- 01
Entries
We look at how people get in: the site, the workspace, the API, email, a shared password, a forgotten test account.
- A list of entry points
- What is open with no sign-in
- Where one password is shared by everyone
- 02
Who sees what
A role must not open someone else’s order, file, or payout through a direct link.
- A check of permissions on the objects
- Links that stay alive too long
- Admin actions in the log
- 03
Data in transit and on disk
Encryption where data travels and where it rests. Secrets stay out of the repository and out of chat.
- The channel to the server
- The backups, and who reads them
- Where the keys are, and how they are changed
- 04
What to close now
Findings are sorted by severity. What is critical is closed before a long report is written.
- A gap someone can already walk through
- What is fixed by configuration
- What needs its own build
- 05
What remains a risk
Not everything is closed the same day. What remains is written down: what it is, who accepted it, and when to return.
- A list of accepted risks
- Who answers
- A second look after it is closed
What we do
- 01A walk through entry points and the API
- 02A check for the usual gaps
- 03Who sees what inside
- 04Encryption where the data rests and where it travels
- 05A list: what to close now, what can wait
How we proceed
- 01A map of the entry points
- 02Check
- 03Report
- 04Closing what is critical
- 05A second look
Stack
- OWASP
- TLS
- Access logs
- Roles
A guide for the timing
The first pass takes one to two weeks. Closing the findings follows their severity.
Outcome
It is clear which gaps are closed, which are accepted as risk, and who answers for that.
What usually comes later
Continuous attack monitoring, and a separate red-team pass once a quarter, are ongoing support, not the first pass.