Threat
Every day. New flaws.
WordPress. PHP. Windows. Citrix. In the last few weeks alone, and all actively exploited. Your application very likely runs on exactly this kind of software.
- WordPressFlaw
CVE-2026-87902
WordPress core before 7.1.2
- Elementor ProFlaw
CVE-2026-32475
Elementor Pro (WordPress plugin)
- WindowsFlaw
CVE-2026-85880
Windows ALPC · Patch Tuesday
- npmMalware
indexed-btree
npm · malicious package imitating sorted-btree
- PHPUpdate
PHP 8.2.34 – 8.5.11
PHP security release
- CitrixFlaw
CVE-2026-88771
Citrix NetScaler ADC/Gateway · zero-day
- PHPFlaw
CVE-2026-109618
PHP 8.2–8.5 · remote code execution
- BinanceIncident
Security incident, withdrawals suspended
Public reports, Sept–Oct 2026. A flaw in a piece of software does not mean a company was affected.
Security check
Test your site. Free.
Names the obvious weaknesses.
Request received.
This check sees 1 of 9 areas. The rest sits behind the login and in the code. What an audit sees →
That did not work. Write to us directly at info@viewconic.de
The privacy policy of Viewconic GmbH applies.
In-depth reports are paid and optional. No obligation. All we need is the URL of your website or app and your email address.
Passive only: no attack, no login.
Security check
example-shop.com
- 2 High
- 5 Medium
- 7 Low
- .git directory publicly reachableHigh
- TLS 1.0 still enabledHigh
- Content Security Policy missingMedium
- Server version visible (nginx 1.18)Medium
- Cookie without SameSite attributeLow
Packages
Four packages. Clear prices. Start for free.
Security check
For every website and web app
free
App audit
For customer portals, shops and SaaS
from€990excl. VAT
Code audit
For software makers and the Cyber Resilience Act
from€1,900excl. VAT
Full audit
For proof to customers, investors and NIS2
from€5,900excl. VAT
Enterprise
Security architecture review
For groups and platforms
On request
- AI in Frankfurt only
- No retention by the AI
- Read-only
- NDA & DPA
All prices net, plus VAT. For businesses only. Contract by individual offer.
Comparison
All packages compared. The further right, the deeper we look.
| Security checkfree | App auditfrom €990 | Code auditfrom €1,900 | Full auditfrom €5,900 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | |||||
| Exposed files, admin and debug pages | |||||
| Login, sessions, rate limits | |||||
| Access rights: can user A see user B’s data? | |||||
| Injection (SQL, XSS, SSRF) | |||||
| Secrets and keys | |||||
| Dependencies and known CVEs | |||||
| Supply chain, Docker, CI/CD | |||||
| Code quality and maintainability | |||||
| Architecture review and threat modelling | |||||
| Cloud infrastructure (AWS, Azure, Kubernetes) | |||||
| What you get | |||||
| Grade and number of findings | |||||
| Report with a prioritised action plan | |||||
| CVSS 3.1 ratings | |||||
| Code findings proven in the running app | |||||
| Expert review of every finding | |||||
| Debrief and re-check | |||||
| NIS2 and CRA readiness mapping | |||||
| Dedicated contact, recurring audits | |||||
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | within 2 hours on working days | 3 working days | 5 working days | 10 working days | individual |
includedpartlynot included
Contact
Let’s talk. We’ll show you where you stand.
15 minutes. Free. No obligation.
Questions
What clients want to know first.
How much does a security or code audit cost?
The security check is free. The app audit starts at €990 (excl. VAT), the code audit at €1,900 and the full audit (application and code) at €5,900, each at a fixed price. For very large applications we quote the price before we start.
What is the difference between a code audit and a penetration test?
A penetration test attacks a running system from the outside. A code audit reads the source code and finds root causes, including ones a pentest never triggers. The two complement each other. We do the code audit.
How long does the audit take?
You receive the Security Check within 2 hours on working days. Once access and code are handed over, we deliver the App Audit in 3, the Code Audit in 5 and the Full Audit in 10 working days. Express makes it faster.
Does my source code leave the EU?
No. The AI runs on Amazon Bedrock in Frankfurt (eu-central-1) with data retention switched off. The AI provider neither stores your code nor trains on it. We delete it once the audit is done.
Is AI-generated code a security risk?
It can be. AI assistants readily reproduce unsafe patterns and outdated dependencies. Our audit reviews AI-generated code as strictly as hand-written code.
Does the report help with NIS2 and customer requests?
Yes. It documents method, scope, findings and actions and works as evidence for customers, auditors and investors. It does not replace a certification.
Which programming languages do you cover?
Among others C#/.NET, Java, Kotlin, TypeScript/JavaScript, Python, PHP and Go with their common frameworks. Your stack is not listed? Ask us.
How do you access the code?
As an encrypted archive or via read access to the repository (GitHub, GitLab, Azure DevOps, Bitbucket). You can revoke access at any time.