Security audits for websites and apps

The best moment to review an app's security is right before it goes public. Fixing a flaw at that stage takes hours; finding it once you have users can mean leaked customer data, a mandatory GDPR notification and trust that is hard to win back.

Security also comes up earlier and earlier: a large client asking for guarantees before hiring you, an investor who wants to know the product holds up, or an app store checking how you handle data. Arriving with an audit done saves you that conversation.

Coding with AI lets you ship in weeks what used to take months, but the assistant doesn't know your business or who should be able to see what. That's why we see the same flaws again and again in apps built this way: service keys baked into the app or browser code, open database rules, API routes that return another user's data by changing a single number, and chatbots that ignore their instructions after one well-crafted message.

Automated tools catch part of it. The flaws that do the most damage are logic flaws, and spotting them takes understanding how your product is supposed to work. That's where it helps that whoever audits also builds websites and apps every day: we know where they break because we know how they're built.

We follow OWASP's reference guides, the open organisation that defines how software security is reviewed, and adapt the scope to what you have: the website and server (OWASP Top 10), the API and backend (OWASP API Security Top 10), the mobile app (OWASP MASVS) and AI features (OWASP Top 10 for large language model applications).

In practice, we check whether one user can see or change another's data, whether login and password recovery can be bypassed, what the app stores on the phone, which keys and files anyone can reach, how the cloud database is configured and what your AI can be tricked into doing.

Before we start, we sign the scope and authorisation with you: which systems we review, on which dates and what is out of scope. Whenever possible we work on a test environment, and with access to the code we go further and faster, although it's not required.

If something serious comes up during the review, we tell you right away, without waiting for the report. Once you, your team or we fix it, we re-check the findings to confirm they're closed.

A two-level report. A one-page summary in plain language for whoever makes decisions: where your product stands and what the business risks are. And the technical detail for whoever codes: each finding with its severity, how to reproduce it and how to fix it step by step, ordered by priority.

If you need it, we also give you a letter stating that the review was done and the fixes were verified, useful to show a client or an investor.

It is not a certification or a compliance audit such as ISO 27001 or Spain's ENS, and we don't sell it as one. It is a technical audit covering what affects the vast majority of websites and apps. If the kind of data you handle or legal requirements mean your case needs something else, we'll tell you and point you in the right direction.