Website and app security audits in NZ

Most website break-ins are not clever. They are an old plugin, a file left on the server, a form that sends email for anyone, or an admin page with no rate limit. We find those before someone else does, fix them, and put monitoring in place.

What a security audit covers

• Software versions, plugins and known vulnerabilities, read properly rather than blindly "fixed"
• Files and scripts that should not be reachable from a browser
• Forms and APIs: spam, injection, rate limits and abuse
• Logins, admin areas, roles and password resets
• Secrets in code, git history and front-end bundles
• Security headers, TLS, redirects and information leaks
• Backups: whether they exist, and whether they restore

Things we have found this year

• Thirty scripts on a health provider's WordPress site that anyone could run from a browser, plus the admin file editor left on
• Command-line maintenance scripts on a media company's site that ran from a web address
• An open SMS relay that would have let anyone send texts at the owner's cost
• A remote-code flaw and an authentication bypass in our own server console, caught in review before it went live

We publish our own review too: the security audit and penetration test of this website is written up in the open, including what we chose not to fix and why.

Fixed price, written report

Every system is different, so we take a short look first and quote the audit at a fixed price. You get a plain-English report with every finding ranked, then a fixed price to fix them. Testing is only ever done on systems you own and have authorised, and never in a way that puts a live site at risk.

Built your app with an AI tool? See vibe-coded app rescue.