Security

Security, before launch. Not after the incident.

We find exploitable flaws in your app while it is still staging, produce a report with working proofs of concept, and ship the fix. One engagement, fixed fee.

Findings rule
No exploit, no report
Window
3 business days
Starts at
$1,000
01 — The new surface

Your 2026 app has threats your 2024 scanner does not see.

Most small-business security tooling was built for a web that did not include language models. Your contact form is audited against SQL injection and XSS — both useful — while the chatbot you ship next to it accepts a paragraph of natural language and feeds it into a model that can call functions, read documents, and send email. That is not the same threat class.

The practical reality is that most service-business sites now contain at least one large-language-model surface: a chatbot, a scanner, a terminal, a summarization endpoint. Each one is an attacker-shaped hole that traditional scanners walk past, because traditional scanners do not know what prompt injection is and do not know how to probe for it.

We do not sell audits by the page. We find the bugs that actually let someone take something from you — credentials, customer data, brand — and we prove them with a working exploit before we write a single line of report.

02 — What we actually see

Five threats worth your attention right now.

Prompt injection in AI chatbots

Reality

A customer-facing chatbot will read anything the user types, including instructions. If the bot can call tools or quote from documents, an injected instruction can rewrite its behavior mid-conversation.

Impact

A booking bot leaking pricing rules. A support bot emailing an attacker a copy of the last conversation. A lead-capture bot giving out a coupon that does not exist.

How we address it

We fence the system prompt, validate tool inputs against an allow-list, and run the exact injection attacks published by Anthropic and OWASP against your specific integration. Bugs we find get a proof-of-concept transcript.

Exposed API keys

Reality

GitHub scans roughly ten million leaked credentials per year. Anthropic and OpenAI keys are now in the top five most-scanned patterns. The usual path is a client-side env var shipped to the browser, a .env file committed by accident, or a screenshot posted in Slack.

Impact

An attacker who gets one Claude key can burn a few thousand dollars of spend in an evening. One OpenAI key with wide scope can touch training data.

How we address it

Pre-commit scanning on every local machine, gitleaks on every push, secrets classifier on every CI run, and a credential inventory with a quarterly rotation date attached to each key.

Supply-chain compromise

Reality

Shai-Hulud in 2024 was the canary. A package update in your dependency tree — four or five dependencies deep — ships obfuscated code that reads AWS metadata or scans your filesystem. Dependabot closes CVEs; it does not catch a brand-new malicious release.

Impact

The attacker does not need to find you. You installed them. Impact ranges from a mining worker pegged to your CI to full credential exfiltration.

How we address it

We pin critical dependencies, enforce provenance on CI installs, and run behavioral scanners on new releases. On a hardening engagement we also audit the top ten transitives of any package touching secrets, payments, or auth.

AI-authored phishing and business email compromise

Reality

A model can now read your company website, write in your voice, and send a wire-transfer request to an employee that looks exactly like something you would send. Volume and plausibility both went up an order of magnitude in 2025.

Impact

The FBI reports business email compromise losses above fifty billion dollars per year. Median loss per incident for small businesses is in the tens of thousands.

How we address it

DMARC, DKIM, SPF aligned and enforced. A DNS pre-change snapshot checklist that would have caught the Vercel-migration email outages we have already written about. Internal drills on invoice-change requests.

Third-party SaaS spillover

Reality

You do not operate the booking vendor, the payment processor, the email sender, the chatbot back-end. When one of them has an incident, the data they hold about your customers is in it.

Impact

You inherit the notification obligation, the trust damage, and often the operational cleanup. Every vendor you integrate widens your breach surface by the breadth of their customer data.

How we address it

We map every outbound integration during the hardening engagement, confirm each vendor has a published security program, scope the minimum data they need to hold, and document revocation paths so a compromise elsewhere does not become a compromise here.

03 — How we think about it

Four principles we apply before a site ships.

Exploit or it did not happen.

A finding without a working proof of concept is a feature request dressed in a lab coat. We only report what we can demonstrate. This is why our reports are short and our remediations land.

Scan the source and the live service.

Static analysis catches intent. Dynamic testing catches reality. We run both against the actual staging URL with the actual repository in hand, so the gap between what the code says and what the server does stops being a hiding place.

Write down every key.

If a secret is not in the credential inventory with a rotation date, it does not exist as far as your operations are concerned. We leave every client with a single register they can actually keep current.

Authorization in writing, always.

Every test runs under a signed authorization clause that names the in-scope systems, the test window, and the out-of-scope vendors. The same clause works in Massachusetts and in Mexico. No verbal go-aheads.

04 — What we ship

Launch Hardening — fixed-fee, three days.

Runs against a staging environment with source in hand. Shipped as a single engagement per site, with a re-scan after fixes.

Price
$1,000
Duration
3 business days, kickoff to handoff
Included
  • AI-assisted pentest (Shannon, white-box) against staging
  • Static analysis on source (Semgrep, OWASP + Next + TypeScript rulesets)
  • Secrets sweep on full git history (gitleaks + custom patterns)
  • Dependency audit (npm, pip, apt — whatever your stack runs)
  • Chatbot and LLM-surface red-team pass (OWASP LLM Top 10)
  • DNS, email-authentication, and vendor-integration review
  • Written report with working proofs of concept for each finding
  • Remediation pull request on the fixes we can land ourselves
  • Re-scan and attestation letter after fixes ship
Not included
  • Compliance certification (SOC 2, ISO 27001, HIPAA)
  • Infrastructure-wide network pentest
  • Social-engineering exercises
  • Ongoing incident response retainer
05 — Our own stack

We test ourselves on the same schedule we sell you.

Every Impleia-owned repository runs the same secret scanning, dependency audit, and scheduled pentest we ship to clients. The current state of our own posture is public.

See our live security posture
06 — Questions

Reasonable things to ask before signing.

Are you pentesting my production system?+
No. The exploitation tooling we use is mutative — it submits forms, triggers endpoints, and can delete records. We test against a staging environment that mirrors production. If you do not have a staging environment, standing one up is the first day of the engagement.
What if you find nothing?+
Most engagements produce at least three actionable findings. If we run the full scope and cannot demonstrate an exploitable flaw, we will tell you in writing, produce the scan artifacts, and refund half the fee. We are not interested in padding reports with theoretical noise.
Is this replacing a real pentest?+
It depends on who is asking. For a service business shipping a marketing site plus a chatbot, it replaces the first-generation commercial pentest and finds more. For a regulated industry requiring an attestation from a named assessor, you still want a qualified pentest firm — we will tell you that up front.
Do you sign an authorization-to-test letter?+
Yes, and it is written into the master engagement letter. The clause names the in-scope systems, the test window, and the out-of-scope vendors. It works under U.S. federal law (18 U.S.C. §1030), Massachusetts G.L. ch. 266 §120F, and the Mexican Código Penal Federal Articles 211 bis-1 through 211 bis-7 for cross-border clients.
What do you actually hand over at the end?+
A PDF report with one section per finding, each including a reproduction transcript, the affected file or endpoint, the severity, and the recommended fix. A remediation PR on the fixes we can land without further discussion. A re-scan report confirming what was closed. An attestation letter suitable for sharing with a partner or investor during diligence.
How do you handle the data you see during testing?+
Scan artifacts live on our infrastructure for ninety days and are then deleted. Finding transcripts that contain customer data are redacted before they enter the report. We do not retain production data, and we will sign a data-handling addendum if your industry requires one.

Before your next deploy, make sure what you built holds.

One engagement, three days, fixed fee. We will tell you on the intake call whether we are the right fit or whether you need a qualified pentest firm.

Schedule a security intakeMessage us on WhatsApp

No compliance theater. No report inflation. Real exploits, real fixes.