Before launch
Pre-launch security audit: check first, then ship.
From the first day online, your application can be found, by customers and by automated scanners. A pre-launch security audit shows what those scanners would find: from outside, behind the login and in the code. At a fixed price, with a report within a few business days.
No penetration test and no load test: we test automatically and with AI support, and every finding comes with its location.
What happens on day one
New TLS certificates appear in public logs. Automated scanners watch these logs continuously and can reach new addresses within minutes of the certificate being issued, as one study shows (Scheitle et al., IMC 2018). They look for known flaws, exposed files and default logins. Which flaws are being exploited right now: our vulnerability of the day.
The timeline, backwards
- 01
Today
Free security check from outside: grade from A to F, usually within 2 hours on business days.
- 02
Audit
App audit in 1, code audit in 2, full audit in 4 business days after payment and handover.
- 03
Fixes
Your team fixes the findings following the prioritised action plan.
- 04
Re-check
We check your fixes again. Included in the full audit, otherwise an option.
Allow two to three weeks before launch, so there is time for fixes and a re-check.
What we check before launch
- Sessions and login: cookies, tokens, logout, rate limits
- Access rights: can user A see user B’s data?
- Secrets: keys and tokens in the code, the frontend and the configuration
- Dependencies: known CVEs in frameworks and packages
- Headers and TLS: encryption, security headers, exposed files and endpoints
What is covered depends on the package: from outside in the security check, behind the login in the app audit, in the source code in the code audit, all of it in the full audit.
Which package fits your date
Security check · free
From outside, no login. Result usually within 2 hours on business days.
App audit · €490
With two test accounts, preferably on staging. The shortest delivery time behind the login.
Code audit · €890
Read access to the code. Report in 2 business days, with Express within 24 hours.
Full audit · €1,690
App and code, every finding reviewed by an expert, with debrief and re-check. With Express within 24 hours.
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
Express costs €230 net and applies to the code and full audit. Details: security check, app audit, full audit, or go straight to booking. Built with AI? AI code audit
What you get
- Report with findings rated by CVSS 3.1 and a prioritised action plan
- Location and a concrete recommendation for every finding
- Clarity before launch: what must be fixed now and what can wait
- With the full audit: debrief and re-check after your fixes
Frequently asked questions
How long before go-live should I have it checked?
Ideally two to three weeks before. That leaves time for fixes and a re-check after the report. You can start the free security check at any time.
Is it possible at short notice?
Yes. The app audit has the shortest delivery time. For the code and full audit there is Express: report within 24 hours on business days, for €230 net. The clock starts after payment and complete handover.
Staging or live system?
For the app audit we prefer staging, and active tests only run with your approval by email. Staging should match the later live system as closely as possible. The code audit needs no running system.
What if critical findings appear?
They sit at the top of the action plan, with location and a concrete recommendation. Whether you postpone the launch is your call. After your fixes we check again on request; the full audit includes the re-check.
Does this replace a pentest?
No. We test automatically and with AI support; a penetration test attacks manually. When each makes sense: Code audit or penetration test?
What does it cost?
The security check is free. The app audit costs €490, the code audit €890 and the full audit €1,690, each net at a fixed price. Express costs €230.
Launch date set? Then check now.
All prices net, plus VAT. Businesses only. Our terms and conditions apply.