Security & Compliance
Application security review, hardening and compliance readiness. Reports are prioritised by exploitability in your actual deployment, not by scanner severity, so the fix list is short enough to finish.
What this covers
Application security review
Authentication, authorisation, tenant isolation, injection and access-control paths, tested against the running system rather than inferred from a checklist.
Hardening the deployment
Secret management and rotation, security headers, transport configuration, rate limiting and least-privilege access across services.
Compliance readiness
Gap assessment and the evidence trail for ISO 27001 and GDPR, including the data-handling questions that need a decision rather than a document.
Have a security & compliance project?
Tell us the problem and the constraints you are working within. We will come back with how we would approach it.
Start a conversationFrom the notes
- CSP for a blob: iframe that prints a PDFWhy printing a PDF from a hidden iframe needs blob: in frame-src, not a data: URL, what the frame inherits from your policy, and what Chrome's PDF viewer does.
- Content Security Policy for Razorpay CheckoutThe Content Security Policy a live billing app ships with Razorpay Checkout, line by line: why a wildcard, why unsafe-inline, and how to prove it is on.
- How to revoke a JWT, from a system that does itThe JWT spec defines no way to revoke a token. Here is the cut-off we run in production, the claim it has to compare against, and the rounding bug it had.