Judge our work before you sign anything. The sample is a 4-page assessment of a fictional retailer: what the business should fix first, how each issue was proven, and the letter your auditor will ask for.
Fictional example. We never publish real client reports.
One issue, shown the way it appears in your report.
The reset token is just the user ID and a timestamp, Base64-encoded. An attacker can build a valid token for a victim without ever opening their email.
Full takeover of any customer or staff account with two requests, including saved addresses and order history.
Use a 256-bit random token, store only its hash, expire it after 15 minutes, invalidate it after one use and rate-limit the endpoint.
GET /account/reset?token=NDIxOjE3NzA2NDA4MTI= # decodes to "421:1770640812" (user_id:timestamp) GET /account/reset?token=MTc6MTc3MDY0MDgxMg== # forged for victim, user id 17 HTTP/1.1 200 OK "Choose a new password for jane.d@northwind.test"
Fictional target. Retest closed this finding on 6 March 2026.
Five stages from first call to verified fixes. Lengths depend on scope and are agreed up front.
A 30-minute call. You get a fixed quote and sign the authorisation.
We map roles, data flows and every entry point with your team.
Manual testing as real user roles. Critical issues reach you the same day.
Findings with proof, impact and fixes, then a walkthrough call.
We verify your fixes and issue an attestation for auditors.
Codex Security