The main protections we build in
- All input is checked on the server — browser checks help users but can be bypassed
- Database queries are written safely so attackers cannot reach your data through them
- Passwords are scrambled using current methods, never stored as plain text
- Login sessions expire and are refreshed whenever permissions change
- Every page checks permissions — being logged in is not enough on its own
- Repeated login attempts are blocked to stop password guessing
Admin panels need extra care
The admin panel is the most powerful part of any system. Whoever reaches it can usually see, change or delete everything. So we treat it differently:
- Kept separate from the public site — different address, separate login
- Hidden from Google so it does not appear in search results
- Every action recorded with the person's name, time and location
- Password required again before deleting records or exporting all data
- Split roles — someone who edits content should not also change permissions
- Optional two-step login and restriction by office location
Server and setup security
We keep testing and live systems completely separate with different passwords, so a problem in one cannot spread to the other.
Passwords and keys live in protected server settings — never in the code, never in files that get copied to other computers, never visible in the browser.
The whole site runs over HTTPS. Error pages shown to visitors say only that something went wrong; the technical detail is recorded privately for us.
Third-party code
Modern applications use many small pieces of code written by others. Each one is a possible way in.
We lock the exact versions we use, check a package before adding it, watch for reported problems, and include updates in the maintenance plan instead of letting them pile up for years.
What you receive
Security documentation is part of every handover: the written review findings, how to manage passwords, who can do what, backup and recovery steps, and who is responsible for updates after launch.
Checking a system someone else built
We also review existing systems. We check logins, permissions, data handling, password storage, connection security and outdated components.
You get a written report with problems ranked by seriousness and a fix list in priority order — useful whether we do the work or your own team does.