Security isn't an afterthought we add at the end of a project, it's part of our process from the first line of code. We follow the OWASP Top 10 during development, monitor published CVEs in the libraries we use, and aim for an A+ score on every project.

That doesn't stop at delivery. Software ages, vulnerabilities get discovered later, and what's secure today might not be in two years. That's why we also review existing projects proactively, and let you know when a technology you're using no longer meets our standard. You then decide for yourself whether to accept that risk.

Internally, we work by the same logic. Two or multi-factor authentication for sensitive accounts, no shared passwords over email or chat, but password managers and expiring links instead.

Still, no process rules out every risk. Did you find a vulnerability in one of our projects yourself? We want to hear about it, in a way that's safe for both of us.