Public exposure
- Public admin/API exposure
- Source maps
- Backup, config and database files
- Directory listing
- Debug/public metadata
- WordPress/WooCommerce exposure signals
Authorised no-login security review
Know what’s exposed before customers, attackers or auditors find it.
Security Snapshot reviews your approved public app, API, WooCommerce and Stripe/webhook surface for exposure, weak controls and risky routes — then gives you evidence-backed findings, practical fixes, limitations and retest proof.
No login required for V2
Written scope first
Evidence-backed report
Not a pentest
VaultDevLabs
Security Snapshot Report
Approved public scope
Approved public app/API surface only
Evidence pack
Screenshots, headers, responses, route notes and findings
Recommended fixes
Practical fix guidance and next steps
Retest proof
Optional before/after proof summary
Built for
SaaS apps
APIs
Stripe/webhooks
WooCommerce
Admin dashboards
Internal tools
Authorised scope only
Human-reviewed findings
No-login V2 by default
Retest proof available
Choose your review
Choose the review that fits your surface
Same fixed-scope Security Snapshot system, routed by what you need reviewed.
Website Security Snapshot
For public websites, SaaS apps, admin dashboards and general web exposure.
View Website SnapshotWooCommerce + Stripe Security Review
For WooCommerce stores, Stripe webhooks, checkout-adjacent exposure and payment-route confidence.
View WooCommerce ReviewPublic API Security Review
For public APIs, OpenAPI/Swagger, GraphQL, CORS, webhooks and route exposure.
View API ReviewWhat it checks
Dense, practical checks across the approved public app/API surface, with limitations kept explicit.
App/API posture
- Security headers
- TLS/HTTPS posture
- CORS and cookies
- HTTP methods
- Cache-control signals
- Rate and body-size signals where applicable
Webhook & payment surfaces
- Webhook invalid-signature rejection
- Stripe/WooCommerce webhook signals
- Payment/admin route exposure
- OpenAPI/Swagger and GraphQL exposure
Evidence coverage
- Crawl coverage
- Approved scope route hints
- Static route hints
- OpenAPI route hints where provided
- Positive controls
- Limitations clearly stated
Sample report proof
A static preview of the client-ready structure: findings, positive controls, limitations, practical fixes and retest proof.
Public sample only. Final reports are tailored to the approved systems, evidence and written scope.
Security Snapshot Report
Public sample structure
No-login V2 review
Findings
7
High
2
Medium
3
Low
2
Example findings
EvidenceFixLimitations
Webhook boundary
Review finding
HighInvalid-signature requests returned a controlled rejection response.
Evidence included in full report
Security headers
Recommended fix
MediumCore headers were present except one browser isolation control.
Fix guidance included
Public route hints
Limitation
LowNo OpenAPI file was provided, so route coverage used approved static hints only.
Scope limitation noted
Security Snapshot path
Scope, evidence and handoff stay connected.
Fixed-fee scope
Choose your Security Snapshot path
Three clear ways to start. Prices are shown ex VAT. Review work starts only after written scope and authorisation are confirmed.
Launch Snapshot
Know obvious public exposure fast
£495
Launch offer
First 10 customers or launch-window fixed-scope review for one approved public surface.
- One public website, store or API
- No-login V2 review
- Evidence-backed findings summary
- Practical fixes and limitations
Standard Snapshot
Evidence pack for fixes and handoff
£895
Core fixed-fee offer after the launch window, built for owners, agencies and technical teams.
- Approved website, API or WooCommerce surface
- Route hints/OpenAPI/static source review where provided
- Full evidence-backed delivery pack
- Positive controls and limitations
- One included retest within 14 days
Snapshot + Retest
Prove fixes actually worked
£1,250
Review plus focused retest
For teams that already know they need the review and a later fix-verification pass after changes are deployed.
- Standard Snapshot evidence pack
- Planned fix-verification pass
- Before/after retest proof
- Fixed/still-present/limited-by-coverage summary
- Useful for client or agency handoff
Payment confirms your request. Security Snapshot work starts only after the approved scope, test window and written authorisation are confirmed.
After your review
Add-ons once the evidence is clear
These are not needed to start. They become useful after the report shows what should be fixed, retested, or watched over time.
Hardening sprint
Apply selected fixes safely
From £1,500
Two-day minimum for tightly scoped remediation after findings are clear.
- Scoped implementation support
- Priority fixes only
- Deployment safety checklist
- Retest-ready change summary
Monthly managed review
Catch regression and new exposure
£295/month
One managed rerun per month with a human-reviewed delta report. Three-month minimum.
- Monthly authorised rerun
- Delta findings and limitations
- Regression watch on public exposure
- Managed service, not SaaS
After payment
What happens next
The commercial flow stays separate from permission to test. Written scope still comes first.
Checkout reserves the review request
Payment starts the commercial request and creates the order trail. It does not expand the approved testing scope.
Scope and authorisation are confirmed
You confirm the public URLs, APIs, webhook paths, route hints and written boundaries before review work starts.
No-login review runs against the approved surface
The review stays non-destructive by default and records evidence, positive controls, limitations and recommended fixes.
Report, handoff and retest path are delivered
You receive the client-ready report. Retest proof can compare before/after evidence once fixes are deployed.
Review guardrails
Authorised scope, non-destructive checks and clear written boundaries.
Authorised scope only
Non-destructive by design
No credential attacks
No data exfiltration
No hidden changes
Written approval for credentialed testing
No-login Security Snapshot does not fully test IDOR, role bypass, logged-in business logic or user/admin permission boundaries. Those require a separate credentialed V3 review with written approval and test accounts.
FAQ
Concise answers about scope, access, retest proof and what sits outside the default review.
Do you need login details?
No for the default review. Security Snapshot can start without passwords and checks the approved public attack surface only.
Is this a pentest?
No. It is an authorised, evidence-backed security review for common public app/API exposure and delivery-ready reporting. It is not a CREST/CHECK pentest or a guarantee that every issue has been found.
What is not included?
The no-login review does not fully test IDOR, role bypass, logged-in business logic, user/admin permission boundaries, brute force, stress, denial-of-service, persistence, or exploitation outside written scope.
Can you test authenticated roles?
Yes, as a separate credentialed V3 review with written approval, test accounts, agreed boundaries and a clear permission to test.
Can you help fix issues?
Yes. The report gives practical recommended fixes. Implementation can be quoted separately after the evidence and risk are clear.
Do you provide retest proof?
Yes. The retest package includes fix verification and a before/after proof summary for agreed findings.
Can you review Stripe webhooks?
Yes. Security Snapshot can review approved Stripe webhook exposure, invalid-signature behaviour and related WooCommerce or SaaS payment routes.
Can you review WooCommerce systems?
Yes. WooCommerce public exposure, payment route signals, webhook behaviour and supporting security posture can be reviewed within the agreed public scope.
See your exposure clearly.
Start with an authorised no-login external review. You get evidence-backed findings, practical fixes, limitations and retest proof without pretending this is a full pentest.
Security Snapshot is an authorised external security review. It is not a penetration test, Cyber Essentials assessment, PCI ASV scan, legal opinion or certification. Findings reflect the agreed scope and test window only. Security improvements reduce risk; they do not guarantee the absence of compromise.
Authorised testing only. No destructive actions. No credential attacks.