Find the gaps
before attackers do.
Audits, authorised penetration tests, code review, hardening and incident response — from the same engineers who build and run production apps.
- Review & audit
- Penetration testing
- Secure code review
- Hardening & WAF
- Incident response
- Monitoring
A report your team
can act on.
Every finding is ranked by risk, backed by evidence and paired with a fix. No 200-page scanner dump.
- — Executive summary for founders and boards
- — Technical detail with steps to reproduce
- — A fix for every finding, and re-tests to confirm
- CriticalAdmin API reachable without a sessionAPI · /admin/█████
- HighPassword reset token does not expireAuth · reset flow
- HighSecret key committed to repositoryRepo · config/█████.ts
- MediumNo rate limit on sign-up and OTPAPI · /auth/████
- LowMissing security headersWeb · all pages
Sample format. Details are invented and redacted.
Authorised, scoped, careful.
Written authorisation first
We only test systems you own or have the right to test. The system owner signs a scope and authorisation before any testing starts.
Agreed scope and windows
Domains, apps, accounts and test times are written down. Anything outside scope is left alone.
No damage by design
No denial-of-service, data deletion or social engineering unless you ask for it in writing, with a separate plan.
Your data stays yours
We touch only the data needed to prove a finding, never keep copies, and share reports only with the people you name.
Fixed scope. Fixed price.
Security review & audit
A clear, prioritised review of your website or app’s security.
See full detailsPenetration testing
Authorised, hands-on testing that proves what an attacker could do.
See full detailsSecure code review
Engineers read your code line by line for security flaws.
See full detailsServer hardening & WAF setup
Lock down servers and put Cloudflare or a WAF in front of your app.
See full detailsIncident response & cleanup
Hacked, leaked keys or malware? We contain it, clean it and close the hole.
See full detailsSecurity monitoring
Ongoing watch over your apps, servers and logins, with fixes when needed.
See full detailsWe describe exactly what we test and how, and show a sample report, rather than lean on badges. If your contract or regulator requires a specific accredited tester, tell us and we will say plainly whether we can meet it.
No. We need written authorisation from the owner of every system in scope. For hosted services, we also follow the host’s own testing rules.
A short executive summary, then every finding with its risk rating, evidence, affected area and the steps to fix it. The image on this page shows the format with details redacted.
Yes. Most packages offer a fix add-on, or our engineering team can take on the work separately. Re-tests confirm each fix.
Do not wipe servers or delete logs. Change the passwords you can, put up a maintenance page if customer data may be at risk, then order Incident response and email engineering@stratummobile.com with “URGENT” in the subject.
We use safe techniques, agree testing windows, and stop immediately if anything looks unstable. Staging environments are preferred.
Know what you need?
Order it today.
Fixed prices, clear delivery times, and a lead engineer who confirms everything with you before work starts.