Authentication & access control
Examine sign-in, account permissions and separation between users. Test whether application workflows allow unauthorised access or bypass important rules.
Security review areas.
Application testing, source review, systems analysis and vulnerability assessment.
APPLICATIONS
Web & API security.
Legacy PHP
Review older PHP applications and their deployment settings. Examine exposed diagnostics, runtime configuration and suspected weaknesses that require controlled testing.
CODE & CONTRACTS
Source & contract review.
Source code analysis
Trace untrusted input through the code. Review dependencies, secrets and configuration. Identify the affected code path and the conditions needed for a weakness to matter.
Smart contracts
Examine contract logic and reproduce suspected failures in an isolated environment. Check the relevant version, program and state before assessing whether a finding applies.
INFRASTRUCTURE
Systems, exposure & identity.
External exposure
Identify public-facing systems and services. Review exposed endpoints, deployment configuration and the evidence of a potential weakness.
Cloud & identity
Review focus: examine infrastructure settings, account permissions and connections between identities to assess access and exposure.
VULNERABILITY ANALYSIS
Validation & priorities.
Finding validation
Assess whether a reported weakness affects the deployed system. Consider the evidence, required access and likelihood of misuse when setting the remediation priority.
Technical readiness
Review focus: organise software inventories, vulnerability records and technical evidence for your team and advisers. This is technical preparation, not certification or legal advice.
Scope & authorisation.
Define the systems, identities, environment and permitted actions. Agree how information is handled, what the report contains and which changes will be re-tested.