~$ rebootworks
03 — run

find the ways in, then keep the lights on

penetration testing and hardening, plus the day-to-day IT that never reaches the top of anyone's list: hosting, backups, monitoring, accounts, and access.

offensive

penetration testing

we go at your site or app the way an attacker would, on a scope you sign off in writing first. then we show you every way in, ranked by what each one would cost you.

  • web application & api testing
  • authentication, sessions, and access control
  • injection, deserialisation, file handling
  • business-logic abuse, the kind scanners never find
  • cloud and hosting misconfiguration
  • exposed secrets, backups, and admin surfaces
  • dependency and supply-chain review
  • a free retest once you've fixed things
testing a system for weaknesses
cat report.md

what the report looks like

two documents: one your board can read, one your developers can act on. neither is a 200-page scanner dump.

the summary

one page. what we found, what it would cost you if someone else found it first, and what to do this week versus this quarter. written for people who don't work in security.

the detail

every finding with the exact steps to reproduce it, the evidence, the severity and why, and a specific fix. nothing in it says "consider implementing input validation".

~/findings/summary
# severity finding fix effort
critical password reset token never expires ~1h
high admin panel reachable without vpn ~2h
high any user can read any invoice by id ~4h
medium database backups world-readable in bucket ~1h
low version disclosure in response headers ~10m
# each one ships with steps to reproduce, evidence, and a named fix.

illustrative sample output, not a real client report

servers and infrastructure being managed
defensive

and the day-to-day IT

the work you only notice when it's missing. we own it so your team doesn't have to learn it on a bad afternoon.

  • hosting and cloud setup, moves, and cost trimming
  • backups we test by restoring them
  • uptime monitoring and alerts that reach a human
  • domains, dns, tls, and email deliverability (spf, dkim, dmarc)
  • google workspace / microsoft 365 accounts and mfa
  • joiner and leaver process, so access is granted and revoked on time
  • laptop, device, and password-manager setup
  • security policies and questionnaire answers for client audits
./incident --response

when something has already gone wrong

site defaced, mailbox compromised, ransomware note, a customer telling you their data is somewhere it shouldn't be. call first, then read this.

first

contain

cut the access being used, rotate credentials and keys, and preserve the logs before anything overwrites them.

then

understand

how they got in, what they reached, how long they were there, and whether they're still there.

after

close and record

fix the way in, restore cleanly, and write the timeline you'll need for customers, insurers, or a regulator.

mid-incident right now? email hello@rebootworks.dev with "incident" in the subject.

man security

security questions

Q:is a pentest legal to run on our own systems?▸
yes, with written authorisation from whoever owns the system. we agree a scope, the testing window, and the rules of engagement in writing before anything starts, and we get sign-off from your hosting provider where they require it. we only ever test what's on that signed scope.
Q:how much does a pentest cost?▸
it's driven by the size of the attack surface: number of applications, roles, and integrations. a single web app with two user roles is a few days' work. we quote one fixed number after a short scoping call, and the retest is included.
Q:how often should we test?▸
annually as a baseline, plus after any significant change to authentication, payments, or your hosting setup. if you ship continuously, a lighter quarterly review usually beats one big annual exercise.
Q:can you help us pass a client security questionnaire?▸
yes. this comes up constantly when you start selling to larger companies. we'll answer the technical sections, write the policies you're missing, and fix the gaps the questionnaire exposes rather than wording around them.
Q:do you replace our IT support?▸
for a small team, usually yes. for a larger one we tend to sit alongside whoever handles helpdesk and take the infrastructure, cloud, and security side. we'll tell you which of those you need.
Q:what if you find nothing?▸
you get the report saying so, with the scope and methods documented, which is exactly what you hand a client or insurer who asked. it happens, and it's a good outcome, not a wasted fee.
$book a security review$all services