A free scanner checks whether the door exists. A Lop tests whether it opens: with real accounts, by hand, and chaining small flaws that look like nothing alone and cost a lot together.
Automated scanners detect known signatures. Access control, session logic and vulnerability chains only show up with authenticated manual testing. Every finding is confirmed with a proof of concept and reviewed by a second Lop.
1Web systemsWeb applications (OWASP WSTG)
Nobody gets into someone else’s account: passwords, password recovery and sessions.
Authentication, account recovery, session management and MFA.
Nobody can slip code or commands in through a form, a search box or a web address.
SQL, NoSQL, command and template injection; reflected, stored and DOM XSS.
Nobody can upload dangerous files disguised as a photo or a PDF.
File upload: type, content, name, path and server-side execution.
Your site cannot be used to trick your visitors or to reach your internal systems.
CSRF, open redirects, SSRF, clickjacking and misconfigured CORS.
Forgotten files and pages: backups, test panels, old versions.
Content discovery: exposed backups, .git and .env, staging environments and unlinked endpoints.
An error on screen does not reveal internal data, keys or code.
Error handling, stack traces, secrets in client-side code and information leaks.
Plugins, themes and site software with known flaws.
Components with known CVEs: CMS, plugins, themes and JavaScript libraries.
Your customers’ data travels protected and is not left exposed in the browser.
Cookies (Secure, HttpOnly, SameSite), security headers, CSP and sensitive data on the client.
Nobody can try thousands of passwords or flood your forms with a bot.
Rate limiting, user enumeration, captcha and anti-automation controls.
2User typesRoles
One user cannot see another user’s orders, invoices or data.
Horizontal access control (IDOR) in views, downloads, exports and internal calls.
A regular user cannot reach admin functions.
Vertical privilege escalation and unprotected admin functions.
What is hidden on screen is also locked behind it.
Authorization enforced on the server, not the browser; tampered parameters and hidden fields.
Servers exposed to the internetExternal surface: ports and services
Everything of yours that is open to the internet, even what nobody remembers.
Subdomain discovery (DNS and certificate logs), ports and services.
Panels, databases or remote access that should not be visible from outside.
Exposed admin services: SSH, RDP, databases, hosting and CMS panels.
Old software with flaws attackers are already using.
Versions with known CVEs, prioritized by real exploitation (KEV and EPSS).
The secure connection, the browser padlock, is set up right.
TLS: protocols, ciphers, certificates and HSTS.
Nobody can take over a subdomain you stopped using.
Subdomain takeover and DNS records pointing to retired services.
Nobody sends mail in your nameSPF, DKIM and DMARC
Nobody sends emails that look like yours to your customers or suppliers.
SPF, DKIM and DMARC: records, policy and alignment.
Your email travels encrypted between servers.
STARTTLS, MTA-STS and TLS-RPT on your mail servers.
Your domain is not on blocklists that send your emails to spam.
Domain and sending IP reputation on blocklists.
Your Microsoft 365 or Google accountsM365 or Workspace configuration (CIS)
Every account has two-factor and no old doors are left without it.
MFA, conditional access and legacy authentication disabled.
Who is an admin, and who should no longer be one.
Privileged accounts, admin roles and inactive accounts.
Your documents are not shared with anyone who has the link.
External sharing and public links in OneDrive, SharePoint or Drive.
Rules that forward your mail outside and apps allowed to read it.
External forwarding, mailbox rules and third-party apps with OAuth grants.
There is a record and an alert if someone gets in where they should not.
Audit logging, alerts and mail filtering, per CIS Benchmark.
1 web application with up to 2 user types.1 web application with up to 2 user roles.
Up to 10 servers or subdomains.Up to 10 hosts or subdomains.
1 email domain.1 email domain, with SPF, DKIM and DMARC review.
1 Microsoft 365 or Google Workspace account, with no cap on users.Configuration review of 1 Microsoft 365 or Google Workspace account, with no cap on users.
Does not include
Mobile apps and the office network. Those go in modules or in Warren.Mobile apps and internal network. Separate modules or Warren.
Tests that could take your service down. We never run them.Denial of service and any destructive test. Out of scope.
Phishing simulation on your staff. It is a separate module.Phishing simulation. Standalone module.
The servers of the company that hosts your site or your store. We test your site and your configuration, not the provider’s platform.Third-party infrastructure: hosting, e-commerce platforms and SaaS. Only the client’s site and configuration.
If your system goes past these limits, we agree on a fixed quote before signing. No surprises.
Questions before you buy
How long does it take and when do we start?
Between 1 and 2 weeks. We start within the week after signing. If it is urgent, write to us and we will see if we can start within 72 hours.
What if you find something serious halfway through?
We tell you the same day. We do not wait for the report to tell you about a critical problem.
My site runs on a hosting service or a store platform. Do you still check it?
Yes. We check your site, your accounts and your configuration inside the platform. The provider’s servers stay out of scope: they are theirs and we have no permission to test them.
Want to see your site the way an attacker does?
One audit, up to 2 weeks, every fix verified. We book the start within the week after signing.
