Accounts and permissions
Review sign-in, account recovery, session handling, and administrator access. Check that each user role can access only the information and actions it needs.
Website Security
Website Security Reviews & Remediation
Review your website, prioritize the risks, and carry security fixes through to verification.
Discuss your website’s securityTurn security concerns into a practical plan
You may have a vulnerability report with no clear owner for the fixes, an aging application with uncertain dependencies, or questions about who can access sensitive information. KBD helps investigate those concerns and plan improvements around the way your application is used.
We review the agreed application scope, explain the findings, and can implement and retest the changes. This work can cover an existing website, a web application, or the APIs and administrative workflows behind it.
Where we can help
Forms, uploads, and APIs
Examine how the application accepts input, handles files, and exposes data through APIs. Improve validation and permission checks around sensitive operations.
Software and configuration
Review dependencies, platform versions, application settings, and handling of credentials. Address outdated components and configuration weaknesses.
Sensitive information
Review how personal and business information is collected, accessed, stored, and recorded in logs. Identify unnecessary exposure and implement appropriate protections.
Code review and remediation
Investigate reported vulnerabilities and examine relevant application code. Fix underlying causes, document the changes, and check affected workflows.
Security through ongoing maintenance
Include security checks in updates and releases. Help teams keep track of dependencies, unresolved findings, and changes that could introduce new risks.
From assessment to improvement
Define the review
Identify the application, key workflows, user roles, data, and operating environment. Agree on the scope and authorized testing before work begins.
Prioritize and improve
Document findings with evidence and practical next steps. Prioritize by impact and likelihood, then implement agreed code and configuration changes.
Verify and hand over
Retest the issues addressed and check affected workflows. Record what was reviewed, what changed, and any remaining items for the team to manage.
What your team receives
Findings with priorities
A record of the issues found within the agreed scope, with affected features, supporting evidence, likely impact, and recommended next steps.
An actionable remediation plan
A sequence of code, dependency, configuration, and access-control changes, including what KBD can implement and what needs input from your team.
Fixes and verification results
When remediation is included, a record of the changes made, the checks performed, and any unresolved findings or follow-up work.
What the security review covers
We define the application, environments, user roles, and authorized testing before starting. The agreed review can combine code inspection, dependency and configuration checks, and targeted checks of important workflows. OWASP’s Application Security Verification Standard can inform the checks selected for the application.
Relevant experience
KBD contributed security improvements alongside reporting, administration, notifications, accessibility, usability, and mobile work for Health Product Shortages Canada. That experience informs our approach to improving established services while supporting the people who use and operate them.
What we need to get started
Begin with your website address, the platform if known, the main workflows, and a summary of your concerns. An existing security report is useful even when another team produced it. We agree on the review scope, access, and how detailed findings will be shared before investigation begins.
Questions clients ask
Can you fix findings from another security review?
Yes. We can investigate the findings against your code and operating environment, confirm the affected workflows, and plan remediation. If a finding needs more evidence, we identify what is needed before committing to a fix.
Can we start with one issue?
Yes. A focused issue or workflow can be a useful first engagement. We define the boundaries, investigate the cause, and document what the review establishes.
Can you support the application afterward?
We can help with dependency updates, release checks, and follow-up improvements. Ongoing maintenance can keep unresolved findings and new requirements visible to the team.
Your next step
Where does your website need attention?
Tell us about your platform, known concerns, and the information or workflows you need to protect.
Discuss your website’s security