Security
Where customer data, logins and payments could be reached by someone who shouldn’t reach them.
- Exposed data and unsafe forms
- Weak login and password rules
- Outdated libraries and missing protections
Your app works. Here's what it's quietly getting wrong.
We test your live app or website for security gaps, broken sign-ups and checkouts, slow pages and device bugs, then hand you one clear report, ranked by what to fix first.
- No issues found? Full refund
- No passwords needed
- Safe, non-destructive checks
Audit report
Example findings- CriticalStrangers can read other customers’ ordersSecurity
- CriticalA public web address hands out your live payment and database keysSecurity
- HighCheckout button does nothing on iPhone SafariBroken flow
- HighLogin accepts unlimited password guessesSecurity
Three things the owner's seat can't show you
Problems like these are easy to miss. Nobody ignored them. They just aren't visible from where you sit.
You test on your own phone, already logged in.
Your customers use older phones, other browsers and no account yet. A button that works for you can be a dead end for them.
Broken pages don’t send emails.
When something fails, most people just leave. Nothing lands in your inbox, so a real problem looks like a slow month.
Old code keeps its secrets.
Developers move on, plugins age and test pages stay online. None of it shows up in your admin panel until someone goes looking.
Built with AI? It still needs a second pair of eyes.
AI tools can get an app running in an afternoon. They're far less good at asking what could go wrong. Code that works in the demo isn't always code that's safe to put in front of customers.
What AI-built apps often miss
- Checks on who can see whatThe page works, so nobody asked whether any logged-in user can open someone else’s order.
- Secrets in the wrong placeKeys pasted into front-end code, a prompt or a public repository.
- Databases left openAccess rules loosened “just to make the error go away”, then never tightened.
- Packages nobody vettedAssistants can suggest outdated libraries, or names that don’t exist and can be registered by someone else.
- No limitsUnlimited password guesses, and unlimited calls to a paid AI service on your account.
// Any visitor can read any orderapp.get("/api/orders/:id", async (req, res) => { const order = await db.orders.find(req.params.id); res.json(order);});// Only the owner can read their orderapp.get("/api/orders/:id", requireLogin, async (req, res) => { const order = await db.orders.find(req.params.id); if (order.userId !== req.user.id) return res.sendStatus(404); res.json(order);});If it's never properly checked
- Customer data gets outOne missing check can put every customer’s details a guess away from a stranger.
- Accounts get taken overWeak login rules and endless guesses make it easy.
- Surprise billsA leaked key or an open AI endpoint can be used by anyone, on your account.
- Trust is hard to win backEmergency fixes, support time and lost customers cost more than finding the gap first.
An audit is the cheap way to find out. Read more in Vibe-coded apps and security: what AI-built software often gets wrong.
Four places apps and websites quietly lose customers
Every audit covers all four, on the app or site you point us to.
Broken flows
The sign-ups, checkouts and bookings that quietly fail.
- Sign-ups, checkouts and bookings that fail
- Dead links, dead ends and confusing steps
- Forms that lose what people typed
Speed and stability
How the site feels on a normal phone and a normal connection.
- Slow screens and page loads
- Crashes, freezes and error messages
- Heavy images and scripts
Devices and browsers
What actually shows up on the screens your customers hold.
- Layouts that break on phones or tablets
- Bugs on older iOS or Android versions
- Problems in Safari, Chrome or Edge
shop.example.com
CriticalStrangers can read other customers’ ordersSecurity
What we found
Changing the number at the end of an order link, from /orders/1042 to /orders/1043, shows another customer’s name, address and purchase. No login for that account is needed.
Why it matters
Every customer’s personal details are one guess away from anyone who tries. Leaks like this can trigger legal duties to notify customers, depending on where you operate, and they’re hard to undo.
How to fix it
Check on the server that each order belongs to the signed-in customer before showing it. Use hard-to-guess IDs as a second layer, and review your logs for signs it has already been used.
CriticalA public web address hands out your live payment and database keysSecurity
What we found
Opening shop.example.com/.env in a browser downloads the file the site uses for its private settings. It contains a live payment secret key and the database password.
Why it matters
Anyone can use those keys to take payments, read the database or pose as your shop. Automated bots check for this exact file on every site they find, all day long.
How to fix it
Move private files out of the public folder, block access to hidden files, and replace every key that was in the file. Rotating them is the step that actually protects you.
HighLogin accepts unlimited password guessesSecurity
What we found
We tried 200 wrong passwords in a row on the admin login. It never slowed down, locked the account or raised an alert.
Why it matters
Attackers can run automated guesses all night. Passwords reused from other breaches make this succeed more often than most owners expect.
How to fix it
Limit failed attempts, require two-step verification for admin accounts, and alert on repeated failures.
HighCheckout button does nothing on iPhone SafariBroken flow
What we found
On an iPhone SE running an older iOS, tapping “Pay now” has no effect and no message appears. The same button works on desktop Chrome.
Why it matters
iPhone shoppers get all the way to payment and hit a dead end. Nothing is logged, so nobody on your team ever sees it happen. It just looks like fewer sales.
How to fix it
A script uses a feature older Safari versions don’t support. The report points to the line, suggests a compatible rewrite, and adds error logging so the next failure is visible.
HighThe server runs PHP 7.4, which stopped getting security fixes in 2022Security
What we found
Response headers and a leftover info page show PHP 7.4 running on the live server.
Why it matters
Flaws found since then stay open on that version for good, and attackers scan the internet looking for exactly these versions.
How to fix it
Upgrade to a supported PHP release on a test copy first, fix the warnings it surfaces, then switch the live site over.
MediumContact form wipes the whole message after one errorBroken flow
What we found
Typing the phone number in the wrong format clears every field, including a long message.
Why it matters
People who wrote a long message rarely write it twice, so you lose the enquiry without knowing it existed.
How to fix it
Keep what was typed when there’s an error, and say which field needs fixing.
MediumLogin cookie can be read by scripts and sent over plain HTTPSecurity
What we found
The session cookie is missing its HttpOnly and Secure settings.
Why it matters
If a malicious script ever runs on a page, or someone is on an untrusted network, the cookie can be copied and used to act as that customer.
How to fix it
Set HttpOnly, Secure and SameSite on session cookies. It’s usually a one-line change.
MediumError pages reveal file paths and database detailsSecurity
What we found
A broken search URL shows a full error message with server folder names and the database user.
Why it matters
It hands anyone a free map of how your site is built.
How to fix it
Turn off on-screen errors on the live site and write them to a log instead.
LowHome page photo is 4.2 MBSpeed
What we found
The hero photo is about 20 times larger than it needs to be.
Why it matters
On a mobile connection it adds around four seconds before the page looks finished.
How to fix it
Resize and compress it, use a modern image format, and load images further down the page only when they’re needed.
Every finding comes with a screenshot or screen recording and a plain-English fix.Get my audit · $79
One price, one app or website
$79one-time, no subscription
- Security review
- User-flow testing
- Speed and stability check
- Device and browser testing
- Prioritised report with fixes
- 20-minute walkthrough call
Nothing to fix? You don't pay.
If our audit doesn't find a single issue worth fixing, we refund your $79 in full. No forms, no arguments.
What we do
- Audit the public version of your app or website.
- Use non-destructive checks only.
- Write up every issue with a screenshot or screen recording and a plain-English fix.
- Walk you through the report on a 20-minute call.
What we never do
- Ask for your passwords or admin access. For logged-in areas, you create a separate test account.
- Run load tests or attempt to break in.
- Make any changes to your data.
- Review anything you aren’t authorised to have tested.
From order to report in 3 working days
Send us the link, and we take it from there.
- 1
Send us the link
Your website address or app store link, plus anything you’re worried about.
- 2
Pay $79
Secure checkout. Covered by the money-back guarantee.
- 3
We run the audit
Our team tests security, flows, speed and devices.
- 4
Get your report
Issues ranked by priority, with fixes and a walkthrough call.
What teams found, and what changed
The issues that mattered, and what happened once they were fixed.
- +31%more iPhone checkouts completedNorthwind Candles, online shopThe audit found a “Pay now” button that did nothing on older iPhones. It was fixed the day after the report arrived.
- 1 dayto close a data exposureBrightline Dental, booking siteAppointment pages could be opened by changing a number in the address. The team locked them down the next day.
- 6.2s → 1.9smobile load timeKestrel Fitness, web appOversized images and unused scripts were trimmed after the speed findings. Sign-ups on phones followed.
“I had been losing iPhone orders for months and never knew. The report pointed at the exact button, my developer fixed it in an afternoon, and checkouts picked up straight away. I only wish I'd done it sooner.”
“The sample report is what convinced me, and the real one was just as clear. Every issue ranked, every fix in plain English. The 20-minute call was worth the price on its own.”
“We built our first version quickly with AI tools. The audit found things none of us had thought to check, like a database rule left open from testing. Calm, specific and no jargon.”
Worth doing if any of these sound familiar
- Your original developer is no longer around
- Customers mention bugs, but you can’t reproduce them
- Sign-ups or sales dropped and you don’t know why
- You’re about to spend money on marketing
- Your app hasn’t been updated in over a year
- You handle customer logins, payments or personal data
- Your app was built with AI tools, or AI wrote parts of it
- Nobody independent has ever tested your app
Real incidents, explained in plain English
What went wrong for other businesses, and what to check on yours.
GuideVibe-coded apps and security: what AI-built software often gets wrong
AI can build a working app in an afternoon, but it's weak at asking what could go wrong. What AI-built apps tend to miss, and how to check yours.
GuideA plain-English website and app security checklist for small businesses
Twenty-eight checks you can run yourself in an afternoon, from forgotten admin logins to unlocked domains. No security degree needed.
GuideExposed .env files and leaked API keys: how to check your site and what to do next
A public .env file or leaked API key hands over your database and payments. Test your site in minutes and learn what to do if you find one.Tell us what to audit
Two minutes now. Your report arrives within 3 working days, and it's covered by the money-back guarantee.
Questions
What happens if you don’t find any issues?
You get your $79 back in full. If the audit finds nothing worth fixing, you shouldn’t pay for it.
What do I get at the end?
A written report listing every issue we found, ranked high, medium or low priority, with screenshots or screen recordings and a plain-English fix for each one. Then a 20-minute call to walk you through it.
Do you need my passwords or admin access?
No. We audit the public version of your app or website. If you want logged-in areas checked, create a separate test account for us. Never share your own password.
Is the security check safe for my live app?
Yes. We use non-destructive checks only: no load testing, no attempts to break in, and no changes to your data. We only review apps and websites you’re authorised to have tested.
Will you fix the problems you find?
Only if you want us to. The report is written so you or any developer can act on it. If you’d like us to fix them, we’ll quote separately.
How long does it take?
Your report arrives within 3 working days of payment.
Our locations
Find us in Casper, Wyoming or in Karachi, Pakistan.
Casper, Wyoming, USA
312 W 2nd St, Casper, WY 82601, USAOpen in Google Maps (opens in a new tab)Karachi, Pakistan
Plot 8 B, Sindhi Muslim Cooperative Housing Society Block A, Sindhi Muslim CHS (SMCHS), Karachi, PakistanOpen in Google Maps (opens in a new tab)Find out what's waiting in your app for $79
And if we don't find anything worth fixing, you get your money back.
Get my audit · $79