Repère Security Website security audit
A website audit whose scope you sign
You decide what is examined, what is put out of reach, and how long the authorization holds. You then receive findings ranked by severity, reviewed by a person, with what to do about each one.
Your website, as the subject of the examination
Many audits sold in Canada cover the IT estate: workstations, servers, internal network, email. That is a useful trade, and it is not this one.
Repère examines the website and what it exposes. That is a distinct object, with weaknesses of its own: code you did not write, forms open to the public, administration accounts, and a server configuration your visitors can read without knowing it.
If your need is about the company's workstations and network, a managed IT firm will serve you better. If the subject is the site, this is the place.
- Access and authenticationActive accounts, how well the admin area is protected, traces of forgotten access.
- Components and versionsWhat the site loads, in which versions, and which of those carry publicly known vulnerabilities.
- Transport and configurationEncryption, security headers, server settings visible from outside.
- Handling of inputHow the site takes what is sent to it: forms, search, URL parameters.
- File exposureWhat answers without being invited: configuration, backups, directories.
- External dependenciesThe third-party services the site calls, and what leaves with them.
Scope and authorization, before any checks
At Repère, the scope and the authorization are put in writing before any check that goes beyond observing what is already public.
A written document, signed and dated, comes before the examination. It is not there for form: it states what we are allowed to do, and it is your guarantee that we will do nothing else.
- What may be examined
The addresses concerned, named one by one. Nothing outside that list is contacted.
- What is excluded
What you put out of reach, for whatever reason you like. Your exclusions are carried over as written.
- The authorized checks
The authorization names what is permitted, and explicitly forbids denial of service, data deletion, persistent modification and bulk sending.
- The limits
What the examination does not cover, written before we start rather than discovered when reading the report.
- The validity period
A start date and an end date. Past the second, the authorization no longer holds.
That document is what makes the examination possible and what bounds it. It protects you as much as it constrains us.
What you receive
A report where every finding answers three questions in this order: what it is, how serious it is, what to do. The findings are ranked, and each carries a remediation a developer can apply as written.
A person reviews every finding before it is sent to you. Nothing reaches you automatically.
The report is yours. You can give it to your developer, a prime contractor, a client or your insurer. It is not a certification: it is the record of an examination, on a date, within a defined scope.
And afterwards?
The report is enough for your developer if they want to handle it: it is written for that.
If you would rather we took care of it, Repère can turn the findings into fixes under a second mandate, quoted separately. We work through the findings from the most serious down, and re-check afterwards. You decide on that second mandate once the report is read, never before.
What makes the price vary
There is no catalogue rate, and an amount quoted without knowing the site would be an amount we could not hold to. Six things determine the quote.
- How wide the scope is
A few-page brochure site and a platform with multiple user areas do not take the same work.
- How many sites
Several domains in one mandate cost less than the same number of separate mandates.
- Whether there is a client area
As soon as there are accounts, there are access rules to check, and that is a whole axis of examination.
- Online payments
A checkout flow adds exchanges with third parties, and therefore surface.
- How deep you want to go
A first look and a thorough examination call for neither the same time nor the same mandate.
- Timing constraints
A site that can only be contacted outside business hours imposes its own schedule.
The quote comes after a first conversation, in writing, and it does not move. Any remediation is quoted separately.
What this audit does not cover
- Continuous monitoring
An audit records the state at a given moment. It is not ongoing monitoring, and we do not sell any.
- A site that is already compromised
If your site is breached right now, that is an emergency and a different trade. Tell us and we will point you somewhere.
- Certification
Repère is not a certification body. No document attests to ISO, SOC 2 or PCI compliance.
- Source code and the IT estate
The examination covers the site and what it exposes, not your repositories, your workstations or your internal network.
Getting started
Four fields, a conversation, then a scope. Nothing is examined before you sign, and the address you give in the form triggers no check of any kind.
If your site runs on WordPress, the audit takes a particular shape. And if you are unsure between an audit, a scan and a penetration test, this guide will help you choose.