WEBSITE SECURITY / EVIDENCE FIRST
A clear assessment. Explicitly approved corrections. A retest bound to the build you actually changed.
Owner-supplied files. Written scope before work.
No automatic scan or security certification.
Technical control, legal authority and evidence are separate checks.
THE EVIDENCE CHAIN / CASE FILE 002 / SYNTHETIC
Seven recorded stages, each sealed with its own evidence digest. The build manifest shows whether the retest observed a different build from the assessment.
06 / RETEST
Select a stage to inspect its recorded digests.
Authorization state: SYNTHETIC record. Fabricated inputs, no customer, no live website, no network requests.
Loading the generated record…
AEGIS / INSIDE THE ATTACK PATH
A sensitive operation is a starting point for investigation. Inspect what reaches it, which checks actually constrain it, and what the evidence still cannot establish.
01 / ENTRY
The fixture passes a renderer-controlled command argument through an IPC handler. Follow the argument to see why reading the sender identifier does not authorize it.
The commercial service remains an agreed offline review of supplied build files. This research illustration expands the explanation, not the service scope. Static reachability is not verified exploitation; absence of an observed path is not a safety certificate.
Define an authorized reviewEstablish the boundaries
A useful assessment starts with the right questions, the right permissions and a defined website.
We agree what to review, the access needed and the evidence you will receive. The scope determines the checks, depth, schedule and proposal.
Tell us what you need →Three distinct engagements
EVY Security Baseline
A limited offline review of one owner-supplied static website build. Ten configuration and exposure check classes, supporting evidence and practical priorities.
EVY Security Hardening
Approved fixes for identified issues. We agree the implementation, review the change and retest the current version before reporting delivery.
EVY Security Continuity Planned service
Periodic checks and regression follow-up are planned as a separately scoped engagement. Coverage and frequency must be agreed before service begins.
This is not an available 24/7 monitoring or incident response service.
Every engagement starts with a written scope and a reviewed proposal. No automatic scans, fixed security tariff or online payment is offered here.
How the work progresses
You stay in control of the assets, the access and the changes.
A request is an enquiry. It does not authorize testing, accept a proposal or start a paid engagement.
Identify the website, the problem and the kind of help you need.
Ownership or written permission, included assets, permitted methods and boundaries are checked before active analysis.
Deliverables, access, schedule and cost are confirmed in writing. Acceptance and authorized payment are separate steps.
Run only the agreed checks. Record reproducible evidence and distinguish findings from unverified assumptions.
Implement the agreed fixes under the permissions you grant, with focused checks and a rollback route.
Validate the current asset version. Deliver the results, corrections and the limits of the review.
Inspect our approach
Our assessment workflow binds every report to the exact version it reviewed. When the asset changes, a report tied to the old version is refused until the new version has been retested.
The end-to-end demo takes a synthetic shop from request to report: written authorization, a static review of the supplied files, approved fixes, a retest and a report bound to the fixed version.
Both linked records were generated by running our code on synthetic files. They are not a customer assessment, a security certification or proof that any website has no vulnerabilities.
The record lists each step, its hashes and the refusal.
Request a Security Assessment
Tell us about your website and the decision you need to make.
Include only information needed to discuss the scope. Please do not send passwords, access tokens, exploit details or sensitive customer data.
Your request is reviewed before a proposal. An entered URL does not trigger a scan or verify permission to test.
Prepare a brief in your browser, then download it or open it in your email app. Nothing is submitted automatically. Prefer email? Write to carlos@evycompany.com.
No. This service checks ten static configuration and exposure classes in files you supply. It is not a penetration test, a live scan or a security certification. Unsupported markup and unreviewed regions are disclosed in the report.
No. We review the request, verify asset authorization and agree the assessment boundaries before any active analysis.
No assessment can guarantee the absence of vulnerabilities. The report identifies the checks performed, evidence collected, version assessed and remaining limitations.
There is no fixed security price or checkout on this page. A reviewed proposal sets the scope and cost; payment becomes available only when the required approvals are in place.
No. Security Continuity is a planned periodic service, subject to a separate agreement. It is not an available 24/7 security operations or incident response service.