Security & Software Quality

In the applications we review, the recurring findings are mundane: an authorisation check applied in the interface but not the API, a dependency three years out of date, secrets committed to a repository, and an admin endpoint that was never meant to be reachable from the internet.

Quality problems follow the same shape. Without automated tests, teams rely on manual checks that shrink under deadline pressure, and the regressions that reach production are usually in code nobody intended to touch.

We review the application for the classes of weakness that cause real incidents - broken access control, injection, insecure direct object references, exposed secrets, vulnerable dependencies, and misconfigured infrastructure - and report findings with reproduction steps, severity, and a concrete fix.

Authorisation gets particular attention, because it is both the most commonly broken control and the one least caught by scanners. We check it at the data-access layer, where it cannot be bypassed by calling a different endpoint.

Then we make the fix durable: dependency scanning and secret detection in the pipeline, authentication built on a maintained provider rather than hand-rolled cryptography, and a test suite weighted toward permission boundaries and the paths where failure is expensive.