We find what is open on your site. Then we close it.

A thorough examination, framed by an authorization you sign. You receive findings ranked by severity and reviewed by a person. If you want, we fix them afterwards.

Have my site assessed See what the report contains
The outline of a site has an opening, which a second line comes to close

Nobody is going to warn you.

A compromised site keeps displaying normally. That is the whole point for whoever is exploiting it. Your host will not alert you, your dashboard will not, and neither will your visitors.

  • Your site starts working for someone else

    Pages that are not yours appear on your domain. When Google notices, it shows a warning to your customers before they even reach you. By the time the warning is lifted, your customers have seen the red page.

  • Your forms only half talk to you

    What your customers write in them, contact details and enquiries included, can be read or diverted without anything changing on screen. A leaking form produces no visible error.

  • Someone asks you for proof, and you have none

    A prime contractor, an insurer, a larger client: more and more of them want a written assessment before they sign. The day you are asked, it is late to order one.

What the audit
goes looking for

Six families of checks, on the public site and what it exposes. Named precisely enough that you know what you are buying, and not precisely enough to serve as a how-to for someone else.

  1. Access and authenticationActive accounts, how well the admin area is protected, traces of forgotten access.
  2. Components and versionsWhat the site loads, in which versions, and which of those carry publicly known vulnerabilities.
  3. Transport and configurationEncryption, security headers, settings exposed publicly.
  4. Handling of inputHow the site takes what is sent to it: forms, search, URL parameters.
  5. File exposureWhat is reachable without being invited: configuration, backups, directories.
  6. External dependenciesThe third-party services the site calls, and what leaves with them.

Transport and configurationreading

  • strict-transport-securitypresent
  • content-security-policypresent
  • x-content-type-optionspresent
  • x-frame-optionsmissing
  • referrer-policymissing

Two gaps out of five. Each becomes a finding, with its remediation.

A thorough examination, not an automated skim.

Nothing is tested outside the signed scope.

No destructive testing, at any point.

Have my site assessed

Nothing starts without
your written consent.

Examining a site you do not own is an offence. That is true for anyone, and it is true for us.

  • The scope What we are allowed to examine, named precisely. Nothing else is touched.
  • The exclusions What you put out of reach, for whatever reason you like. They are carried into the authorization as written.
  • The forbidden tests Denial of service, data deletion, persistent modification, bulk sending. Forbidden by the authorization, not only on principle.
  • The person who authorizes Their name, their role, and confirmation that they have the authority to do so.
  • Two dates One start, one end. Past the second, the authorization no longer holds.

That document is what separates us from an online tool: a tool tests any address it is given, without asking who it belongs to.

The authorized scope separates what is examined from what is not IN SCOPE Public site Forms What it exposes EXCLUDED

The solid line is what you signed. The dotted one is put out of reach.

Your report becomes
your action plan.

Every finding answers three questions in this order: what it is, how serious it is, what to do. No jargon, no screenshots of tools, no raw list for someone else to sort out.

  • A severity levelso you know where to start, without a misleading overall score.
  • A plain-English explanationof what the finding means for your site.
  • A remediationyour developer can apply as written.
  • Follow-upeach finding moves from open to acknowledged, then to fixed.
Have my site assessed

Repère Securityreviewed before sending

Report excerpt: how a finding is structured

  1. 01Outdated componentHigh

    A component of the site has been left on a version for which vulnerabilities are publicly known.

    To do. Update the component, then check that the function it provides still works.

  2. 02Missing security headerMedium

    The server does not send an instruction the browser knows how to apply to limit certain kinds of abuse.

    To do. Add the header on the server, and check that no page breaks as a result.

  3. 03Version information exposedLow

    The site publicly announces the version of one of its components, which makes reconnaissance easier.

    To do. Remove the information from the server response. No visible impact for your visitors.

Example structure. No client site is shown here.

From enquiry to report.

  1. You describe your site

    A short form. Nothing is tested at this stage, and the address you give triggers no check of any kind.

    • No test run
    • No commitment

  2. We talk it through

    A call to understand what you have, what worries you, and which level makes sense.

    • Recommended level
    • Written quote

  3. You authorize the scope

    The authorization is written, signed and dated. It names what is examined, what is excluded and what is forbidden.

    • Scope
    • Exclusions
    • Forbidden tests
    • Validity dates

  4. The audit happens, within those limits

    Nothing outside the scope. Nothing destructive. No test against an address that is not listed.

    • Six families of checks
    • No destructive testing

  5. A person reviews, then you receive it

    Every finding is checked before it reaches you: nothing is sent automatically. We then go through the report together.

    • Ranked findings
    • Remediation per finding
    • Report you can share

  6. We fix it, if you want us to

    The report is enough for your developer if they want to handle it. Otherwise we set up a second authorization to take the findings one by one and close what was found, from the most serious down.

    • Remediation mandate
    • Prioritized by severity
    • Re-checked afterwards

Three ways
to start.

The right level is decided on the call, not in a form. The quote comes after, and it is fixed.

To find out where you stand

Assessment

A first look at your public site, to place the situation and decide whether a full audit is warranted.

  • A surface examination
  • The points worth attention
  • A recommended level
  • No commitment to go further

For a thorough examination

Security audit

The examination framed by an authorization, with a detailed report and a prioritized remediation plan.

  • Written authorization and signed scope
  • The six families of checks
  • Findings ranked by severity
  • Remediation for every finding
  • Human review before sending
  • We go through the report together

When the usual frame does not fit

Custom audit

When the scope falls outside the usual: several sites, an application, constraints of your own.

  • Scope defined with you
  • Constraints and windows respected
  • Reporting adapted to your audience

No amount is shown here because none would be honest without knowing your site. The quote comes after the call, in writing, and it does not move. Remediation, when you hand it to us, is a second authorization quoted separately: you decide after reading the report, not before.

What we
do not do.

On a security service, the limit matters as much as the promise. Here is ours, in full.

  • We do not monitor your site continuously

    An audit records the state at a given moment. It does not replace ongoing monitoring, and we do not sell any.

  • We do not work on a site that is already compromised

    If your site is breached right now, that is an emergency and a different trade. Tell us and we will point you somewhere.

  • We certify nothing

    Repère is not a certification body. None of our documents attests to ISO, SOC 2 or PCI compliance.

  • We do not audit your source code

    The examination covers the site and what it exposes, from the outside. Not your repositories.

  • We do not touch your IT estate

    Workstations, internal network, email: out of scope.

Those two needs belong to the house next door.

RepèreQuébec Quebec Law 25 compliance: consent, privacy policy, trackers, designated officer. RepèreMaintenance Routine upkeep: updates, patches, small fixes and technical follow-up.
Clément Marty, founder of Repère

The person who runs the audit
is the person who answers you.

My name is Clément, a web developer in Montréal. You will not be handed from a salesperson to an analyst, then from an analyst to support. You talk to someone who has read your report because he wrote it.

Have my site assessed

One brand.
Three specialties.

The same clear view of compliance, upkeep and security for your web presence.

Repère Québec Quebec Law 25 and Law 96 compliance Repère Maintenance WordPress maintenance for small businesses Repère Security Website security audits

Common questions

If yours is not here, write to us. We answer in English, and we answer plainly.

Can you check my site without authorization?

No. Examining a site without the owner's permission is an offence, and we do not do it, not even for a demonstration. It is also why there is no “scan my site” button on this page: the first conversation exists precisely to establish who authorizes what.

How far does the audit go?

As far as the signed scope allows. It is not an automated surface scan: we go looking for what is not visible from the home page, across the six families of checks, and every finding is verified by hand before it reaches you. What bounds the examination is your authorization, not a tool.

Do you fix what you find?

Yes, if you want us to. The audit and the remediation are two separate mandates: you are never obliged to give us the second. Many clients leave with the report and hand it to their developer. It is written for that. When you would rather we handled it, we work through the findings from the most serious down, and re-check afterwards.

What happens if you find nothing?

You receive the report anyway, and it states what was examined. An absence of findings is not proof that there is nothing: it is the result of an examination, on a date, within a given scope. We will never write that your site is secure.

How is this different from Repère Maintenance?

Maintenance handles routine upkeep: updates, patches, small fixes, technical follow-up over time. Security runs a one-time, scoped examination and hands you a report. Many small businesses need both, but they are two distinct services and you do not have to take one to get the other.

Can I share the report with a third party?

Yes. The report is yours. You can give it to your developer, your client, a prime contractor or your insurer. Just note that it is not a certification: it is the record of an examination.

Does filling in the form start anything?

No. The form creates an enquiry, nothing more. No test is run, no address is contacted. The first thing that follows is a conversation, and checking only begins once the scope has been signed.

Going further

The service pages, and four guides written for business owners.

Tell us what you have.
We will tell you what makes sense.

Four fields. We come back to you to frame the need, and we will tell you plainly if an audit is not warranted.

No cold calls, no chasing.

Sending this form triggers no check of any kind. The address you give is used only to prepare the conversation: nothing is tested before you have signed a scope.

Or write to us: security@byrepere.com