Leaked secrets
Passwords, API keys and payment keys in the files and in the version history. The report gives their location, never their value.
Security review · website, webshop, web application
Security review – find out what your site shows to the outside world.
We review the source code of your website, webshop or web application and write down what we find: a leaked password, a downloadable backup, an injectable form, an outdated library. You can read the report yourself, and your developer can work through it line by line.
What we check
Six checks, one report.
Downloadable files
A config file, database backup, log or .git folder left in the web root – things anyone can take with a single request.
Injectable code
Data that reaches a database query, a system command or the page itself without validation (SQL injection, XSS), unsafe file uploads. We review every automated finding by hand.
Attack probes
We start the PHP pages in a test environment cut off from the network – on a copy of your code, not on the live site – and call them the way an attacker would.
Outdated libraries
We compare the versions of the bundled JavaScript and PHP packages with the public database of known vulnerabilities.
Live site settings
On request: https, security headers, cookies, and whether the server really serves sensitive files. A few read-only requests, only with your written authorisation.
Sample report
This is the report you get – this one was made for a fictional restaurant.
- 15 pages at most, starting with a summary: is there anything urgent, and in what order to fix things
- For every issue: what is wrong, where it is (file and line), and what to do
- The limits of the review in a separate chapter: we write down what we did not check
- We measure ourselves too: on a deliberately vulnerable practice project (DVWA), the code analysis flagged issues in 12 of the 19 vulnerability modules. The rest are mostly logic flaws, which only targeted manual testing finds (11 November 2026)
The images come from the sample report: a fictional client and deliberately flawed sample code. We never show a real client's report to anyone.
Pricing
Review of a smaller website
€150one-off fee
from €300webshop, booking system, larger application
- All six checks
- Manual review of the automated findings
- Report as a PDF, 15 pages at most
- Full list of findings for your developer
- A description of the limits of the review
What counts as a smaller website?
A brochure site or a small web application, up to roughly 100 source files, with one live address. For webshops, booking systems and client portals we give a written price after looking at the code.
Re-check
Once the issues are fixed, we run the review again for €50 and write down what improved and what remains.
If we built your site
The review is part of the handover; you don't pay extra for it.
Not included
Fixing the issues (we give a separate quote on request), load testing, and manual testing of the pages behind the login.
We don't charge VAT (exempt small business), so the price shown is the full price.
How does it go?
01
You authorise us
We put in writing what we check and what we don't. We only review a site its owner has authorised us to review.
02
You send the code
We need the source code, without the live database or customer data. If you don't know where to download it from, we help.
03
We review it
The automated checks run on a copy of your code, in a test environment cut off from the network. Then we go through the findings one by one.
04
You get the report
To-dos in order of priority. We delete the copy of the code 30 days after handing over the report.
Frequently asked questions
What is a security review?
A check of a website's source code and settings for known types of flaws (a vulnerability assessment): leaked secrets, downloadable files, injectable code, outdated libraries. The result is a report that lists the issues and the to-dos by severity.
Is this a penetration test?
No. A penetration test is a manual attack attempt against the live system that takes several days and typically costs several times this price. We review the code with automated tools and by hand: this finds the common, technical flaws, but not authorisation or business-logic flaws.
Do you touch my live site?
Not by default: we work on a copy of your code on our own machine. If you also ask for the live site settings, we send a few read-only requests – no load, no password guessing, no form submissions – and only with your written authorisation.
What doesn't the review find?
Logic flaws: who can see what, who can order what, what happens at payment. We don't check the pages behind the login, the hosting and database settings, password strength or your team's devices either. The report says so too.
If you find nothing, is my site secure?
It means we found none of the flaw types we check for on that day. The report is a snapshot, not a certificate: it doesn't replace regular updates and backups.
Who sees my code?
We treat it as confidential, and the written agreement records where and with what tools we work on it. We don't ask for the live database or customer data; we delete the copy of the code 30 days after handing over the report.
Do you review WordPress sites?
Yes, but the scope is narrower there: we review the custom theme and any custom-built plugin. Checking installed plugins for known vulnerabilities is not part of the review yet – we state this in the quote.
Do you fix the issues?
On request we give a separate quote. The report is written so that your own developer can fix the issues from it; afterwards we re-check for €50.
How much does a security review cost?
A smaller website €150, a webshop, booking system or other larger application from €300, a re-check €50. You get the exact amount in writing after we have looked at the code.
Let's look at your site
Tell us what kind of site it is and who built it – we'll write back what we can check on it, and for how much.