Penetration testing of web applications, APIs and mobile apps, security audits of websites and online stores, code review. Experience in bug bounty programs of financial institutions and a crypto platform.
5.0 from 4 Google reviewsMost breaches do not start with a sophisticated attack. They start with an outdated plugin, a forgotten test account, an API that returns someone else's data when you change one number in the URL, or an admin panel without a second layer of protection. The owner finds out when customers start calling.
A penetration test is a controlled attack with your permission. We look at the system the way an attacker would, and we tell you what we found, how dangerous it is and how to fix it. No scare words and no 200-page report of raw scanner output.
Financial and insurance systems, where security requirements are the highest. We have also worked on other projects that we do not list publicly.
We found a vulnerability in the platform, reported it responsibly and it was fixed. We publish this with the permission of altcoins.bg; the details remain confidential.
We take part in private bug bounty programs run by financial institutions. Their terms are confidential, so we do not name the companies or describe the findings.
Every finding goes only to the owner's security team, within the rules of the program, and is never published without permission.
Manual testing against the OWASP Top 10 and beyond: login and sessions, access rights, injections, file uploads, business logic. We look for what scanners miss.
REST and GraphQL APIs, mobile apps for iOS and Android: authentication, access to other users' data, information leaks, rate limits.
WordPress, WooCommerce and other platforms: outdated plugins, weak passwords, exposed admin panels, wrong permissions, payments and customer personal data.
We read the application code and look for vulnerabilities at their source. Useful before launching a new product or after a major change.
Configuration of servers and cloud services, open ports, SSL, DNS, SPF, DKIM and DMARC, so nobody can send email in your name.
We help you set up a vulnerability disclosure program: rules, scope, security.txt and a response process, so you are the first to hear about a problem.
Four steps, each with a clear result. You know what is tested, when, and what you will get at the end.
We agree on which systems, which environment and which timeframe. We sign a contract with written authorization and, if needed, a non-disclosure agreement.
Manual work, supported by tools. We agree on the testing windows so we do not disrupt your customers, and we stop immediately if we find something critical.
Every vulnerability with a risk level, proof, steps to reproduce and a specific recommendation. Plus a short plain-language summary for management.
Once your team or we have fixed the issues, we test again and confirm in the report what has been closed.
No two tests are alike. That is why we do not list a price upfront. After a short call we send you a quote with a clear amount (excl. VAT) and timeline, before we start.
We test only systems for which the owner has given us written permission, and only within the agreed scope.
What we find stays between us and you. We do not publish vulnerabilities or show reports without your consent.
We rank the problems by real risk. You hear about anything critical right away, by phone, not at the end of the test.
Is your website hosted with us? The basic protection is already part of website maintenance: updates, backups, a protected login and monitoring. A penetration test is the next step once you have an application, payments or a lot of customer data.
The price is a custom quote and depends on the scope: number of systems, type of test, roles, environment and timeline. After a short call to define the scope, we send you a quote with a clear price and timeline before we start.
A small company website or store takes a few working days. A web application with an API and several user roles usually takes from one to several weeks. The exact timeline is in the quote.
It should not. Tests that could put load on the system are run in an agreed window or in a test environment. We do not run denial-of-service attacks unless you explicitly ask for them and we agree on it.
No. We work only on systems for which we have written permission from the owner, with a clearly defined scope. Bug bounty programs are a public permission with their own rules, and we follow them strictly.
Yes. Everything we see during the test stays between us and you. The report goes only to the people you name.
Yes, if you want us to. We can fix the vulnerabilities ourselves, especially on WordPress and on sites we maintain, or hand the report to your developers and then verify their fixes.
A program in which a company allows outside researchers to look for vulnerabilities in its systems under defined rules and rewards valid reports. We take part in such programs and can help you set up your own.
Send us the address of the system and a phone number. We call you, define the scope and send you a quote with a price and timeline. Reply within 24 hours, no obligation.
ProWebsite AI Consultant, the conversation is recorded. Urgent: +359 894 23 52 23