Security built in, not bolted on.
We treat security as a design constraint, not a checklist at the end. Authentication, access control, encryption and monitoring are decided at the architecture stage, before the first line of code.
- Decided at
- Architecture, not post-launch
- Baseline
- OWASP Top 10
- Certifications
- Scoped per project, never implied
Cheap at architecture time. Expensive after launch.
A missing rate limit found in review takes an afternoon to add. The same gap found after a credential-stuffing attack costs the client their users' trust, their data and weeks of clean-up.
So authentication models, data access rules and secret handling are settled in the architecture phase, not in a post-launch audit.
- Input validation
- Architecture
- Access control design
- Architecture
- Secrets management
- Before first deploy
- Dependency audit
- Every sprint
- Code review
- Every pull request
- Monitoring and alerts
- Launch day
What we secure in every system.
Applied in proportion to the risk profile of the system. A marketing site and a payments backend don't get the same treatment, and shouldn't.
Application
- Authentication on standard protocols: JWT, OAuth 2.0, magic links
- Role-based access control, so users only see what their role permits
- Input validation and sanitisation on every API endpoint
- Parameterised queries and output encoding against SQL injection and XSS
- Rate limiting against abuse and credential stuffing
- CSRF protection on state-changing requests
Data
- TLS on every database connection
- Passwords hashed with bcrypt or Argon2, never stored in plain text
- API keys and tokens in environment variables, never in source
- Least-privilege service accounts for database access
- Automated, tested backups stored off-site
- Field-level encryption at rest where the risk calls for it
Infrastructure
- HTTPS on every public endpoint, no plain HTTP
- Development, staging and production kept isolated
- Firewall rules limited to the ports and IPs that need them
- Key-based SSH only
- Containers run as non-root users
- Security groups and VPC configuration reviewed per deployment
Development
- Automated dependency audits with alerts for known vulnerabilities
- Code review on every pull request, no direct pushes to main
- OWASP Top 10 checks built into day-to-day practice
- Secure coding guidelines reviewed with the team at kickoff
- Third-party packages evaluated before they are added
- No production secrets in staging
Operations
- Security-relevant events logged: sign-ins, permission changes
- Error monitoring that separates operational errors from security events
- A written process for handling a reported vulnerability
- Credentials handed over securely at project handover
- Alerts on unusual traffic after launch
We don't claim ISO 27001, SOC 2, PCI or HIPAA certification.
If a client needs an audited compliance programme, we say so at the start and scope it explicitly. For regulated industries such as healthcare and finance, compliance requirements are part of the written scope before any work begins.
Worried about an application you already run?
Our free project audit reviews the architecture, flags the risk areas and outlines what a fix would involve. Plain English, no obligation.
- Written scope
- Within 24 hours
- Pricing
- Fixed per milestone
- Ownership
- 100% of code and IP