Application security review and remediation
Security for companies moving
too fast to be slowed down
Read-only · What we store
Read-only. We record which domain was checked and keep anonymous result statistics. If you ask us to email the report or watch your domain, we also store your email and a summary of the result. See our privacy policy.
Full security review£1,200 · 1–2 weeks
Request a reviewThe Surface Check is the outside view. A full security review goes inside your app, into the access control, authentication and logic flaws a scan cannot see.
- £1,200
- fixed price, published for everyone
- 1–2 weeks
- from kickoff to report in hand
- 1 working day
- response to every business enquiry
What you get
A clear, prioritised report your team can act on, every finding in plain language, scored by severity and fix effort, with the exact steps to fix it.
Executive Summary
What we found, why it matters and what to fix first, written so a busy founder can read it in minutes and share it with the people who need to act.
Detailed Findings
What each issue is, where it is, why it matters and exactly how to fix it.Every finding is ranked by severity, so the dangerous ones stand out at a glance.
Remediation Roadmap
A ranked fix plan, highest-risk and lowest-effort first, showing what to do now, what comes next and what can wait.
An example finding, as it appears in our reports
Changing the workspace ID in the URL exposes another company's data
The dashboard trusts the id in the web address and never checks ownership on the server.Any signed-in user can read another tenant's data by changing the number.
The fix: verify on every request that the signed-in user owns the requested workspace ID.Estimated at 2–4 hours.
High severity, small effort: the most risk removed for the least money.
How we handle your code securely
We know you're trusting us with sensitive access. Here's how we protect it.
We ask for the lowest level of access that allows the work.Credentials you share are kept encrypted in a password manager, seen only by our two directors, and deleted at the end of the engagement, confirmed to you in writing.
Confidentiality is in our engagement terms, so you're protected without a separate NDA.Your code, systems and our findings stay confidential, and the report is for your internal use. If procurement needs a separate NDA too, we'll sign one.
Within five working days of the engagement ending we revoke access and delete your credentials, scan output and working material, confirmed to you in writing.We keep the report, signed paperwork and our record of the changes for six years, encrypted, to defend a claim and meet our accounting and insurance duties. Our data handling policy has the full schedule.
Proof, not promises
You’re trusting us with your code and access, so we’d rather show you than tell you. Check any of it yourself.
Check your own site free
Run our free checks on your own domain and see the quality of the findings before you ever speak to us. No sign-up, no card.
Run a free check →We hold ourselves to it
We run the same external check on our own domain and publish the live result. A security company should pass its own test, and you can confirm ours right now.
See secvura.com’s own result →Nothing hidden in the price
Fixed prices, published in full, with an effort estimate on every issue. You know the cost of a piece of work before you commit to it, in writing.
See the pricing →
What the review actually looks like
One fixed price, from kick-off to a report your team can act on, usually one to two weeks. Here’s roughly how it goes.
Step 1
Scope and kick-off
We agree what is in scope, in writing, and you authorise the work before anything is touched. Nothing is scanned until you have signed a written authorisation naming the systems.
Step 2
Hands-on review
We assess your application and the systems behind it, combining automated tooling with the hands-on manual work a scanner can’t do: broken access control, tenant isolation, authentication and logic flaws.
Step 3
Prioritisation
Every finding is scored by severity and by fix effort, so the dangerous, quick wins stand out from the noise.
Step 4
Report and remediation roadmap
A plain-language report your team can act on, with a sequenced plan to fix, whether we do the fixing or you do.
See a sample report
Optional remediation follows at £1,500 per 20-hour block, where we prepare the fixes and verify each one. You are never committed to it.
Services and pricing
Fixed prices, published for everyone, with an effort estimate on every issue. You know the full cost before you commit. If a piece of work looks likely to run over, we stop and agree the next step with you first. No surprise invoices.
Fixed price, no VAT added. Stages 2 and 3 are optional, and nothing is scanned until you have signed a written scope.
Request a security review
Who you'll be working with
You work directly with the two of us, no sales team, no handoffs, from first call to final fix. That matters when you're handing over access to your code and data.
Amirali Khezrey
Co-founderAmirali runs scoping, prioritisation and communication on every engagement. He agrees exactly what is in scope before any work starts, and keeps you across findings and progress from the first call to sign-off.
Shyueb Sediqi
Co-founderShyueb runs the review and remediation side of each engagement and is a direct point of contact from the first call to the final report. No handoffs, no black boxes.
FAQs
Ready to secure your app?
Request a security review.We'll respond within one working day.
You work directly with the two founders. No sales team, no handoffs.
Or email us directly:
contact@secvura.com