Application assessment
Find the gaps before someone else does
I dig into your web application with an attacker's perspective — looking at auth flows, access control, input handling, and the configuration details that tend to get overlooked. The goal is to surface the issues that actually matter, not just run a scanner and hand you a PDF.
What you walk away with
A clear picture of where your app is exposed, which issues are worth prioritizing, and specific guidance on what to fix first — without the noise.
Assessment
I look at your web app the way an attacker would — then tell you what actually needs fixing and why.
What this covers
- Your app's attack surface — user flows, exposed endpoints, and anything public-facing
- Auth and session handling: login, password reset, token management, and the assumptions behind them
- Access control gaps — privilege escalation, broken object-level access, missing checks
- Input handling: injection vectors, unsafe parsing, weak validation
- Config and deployment issues that quietly widen the attack surface
Best for
- Startups getting ready to ship or scale something customer-facing
- Small teams that want a real security look without a heavyweight process
- Products dealing with user accounts, permissions, or sensitive data
- Developers who'd rather get actionable findings than a 60-page report they'll never read
How I work
Get the lay of the land
I start by understanding how the app is supposed to work — where sensitive actions happen, what the trust boundaries are, and where things could go wrong.
Go after the weak spots
I test the routes, states, and edge cases that tend to hide real issues — not just the obvious stuff a checklist would catch.
Write it up so you can act on it
Every finding comes with context, impact, and concrete next steps. No vague risk ratings — just what's broken and how to fix it.
What you get
- A short, focused report with validated findings and severity context
- Remediation guidance for each issue — specific enough to hand to a developer
- A prioritized list so you know what to tackle first
- Follow-up support if anything in the report needs clarification
Attack surface review
Want to know where your app is exposed?
Whether you're preparing for launch, recovering from a change, or just want a second pair of eyes — I can take a look.
Related services