Web application development
Web applications designed, built and tested with security as a requirement from day one.
- Threat modeling before design sign off
- Secure authentication and session design
- Server side validation and authorisation
- Dependency and secret hygiene
- Security headers and hardening
- Security testing before release
The business problem
Most security problems are designed in long before they are tested for. Fixing them after launch costs far more than building them out at the start.
Scope of work
Scope is agreed with you before any work starts. A typical engagement covers the areas below, adjusted to your environment, your priorities and any testing windows you need.
- Threat modeling before design sign off
- Secure authentication and session design
- Server side validation and authorisation
- Dependency and secret hygiene
- Security headers and hardening
- Security testing before release
Methodology
Security is considered at every stage, not checked at the end.
- Discovery
- Threat modeling
- Architecture
- Secure build
- Code review
- Security testing
- Release
- Support
Typical engagement timeline
Depends on scope. Planned in milestones.
Standards and references
- OWASP ASVS
- OWASP Top 10
- CWE Top 25
Tools and techniques
- Modern web frameworks
- Automated testing
- GARUDX code analysis
- Continuous integration
What you receive.
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Benefits
- Fewer vulnerabilities reach production
- Lower cost than fixing after launch
- Security evidence for your customers
- A codebase your team can maintain
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Why us.
- Experienced security professionalsAssessments are led by practitioners who do this work every day.
- Offensive security expertiseWe think like attackers because that is our core discipline.
- Manual validationEvery finding is confirmed by a person before it reaches your report.
- Enterprise focused assessmentsScoping, communication and reporting that fit large organisations.
- Transparent reportingEvidence, reproduction steps and plain language. No padding.
- Actionable remediationSpecific fixes your developers and administrators can apply.
Questions.
Do you security test what you build?
Yes. Every build goes through code analysis with GARUDX and security testing before release.
Can you work with our existing team and stack?
Yes. We can build alongside your developers or deliver a complete product, using the stack that fits the project.
Who owns the source code?
Ownership terms are agreed in the contract before work begins.
Do you support the product after launch?
Yes. Support and maintenance terms are agreed as part of the engagement.