Find the holes before someone else does.
A fixed-price security review of your PHP website or application. You get a plain-English report of what's exposed, how serious it is, and exactly how to fix it.
Pick your tier
| Tier | Price | Covers | Turnaround | |
|---|---|---|---|---|
| Starter | $495 | Public pages and forms: an automated vulnerability scan, plus hands-on hostile-input testing of up to 10 forms (login, contact, search, uploads) | 5 business days | Buy Starter |
| Standard | $1,250 | Everything in Starter, plus a line-by-line review of up to 100 PHP files for SQL injection, cross-site scripting, CSRF, broken access control, session handling and file uploads | 10 business days | Buy Standard |
| Payment-Flow | $2,500 | Everything in Standard, plus checkout or donation flows, the payment gateway integration, admin areas and stored customer data | 15 business days | Buy Payment-Flow |
Who it's for
- Businesses that take payments or donations online
- Sites with customer logins, portals or stored personal data
- Owners who inherited a PHP site and don't know what's in it
- New PHP apps about to launch
This review covers PHP applications. If your app was built with AI tools on another stack, ask about a core PHP rebuild instead.
What you get
- A written report. Each finding includes its severity, where it is (page, or file and line), how it could be exploited, and how to fix it.
- A 30-minute call to walk through the results
- A fixed quote to fix everything found, if you want us to do it
- A free re-test of every fixed item when we do the fixes
What we need from you
- Written authorization to test. Security testing runs only on systems you own or have written permission to test.
- Hosting or control-panel access (or SSH), a copy of the code, and a database copy. We set up a staging copy if none exists.
- No work starts until we confirm your app fits the tier bought. If it's bigger, you can move up a tier or get a full refund.
Why Web Shopping Systems
Our code passed a U.S. Department of Housing and Urban Development security review on the first try. We've spent years building payment and donation systems, including the GiveDirect.org platform. Claude Code helps trace every input through your code quickly, and each finding is confirmed by hand before it goes in the report.
Frequently asked questions
Will testing disrupt my live site?
Code review happens on a copy. Live testing is limited to non-destructive checks at times we agree on.
Is this a PCI compliance audit?
No. It's a security review, not a PCI DSS assessment or certification.
Do you fix what you find?
Yes, for a fixed price quoted from the report. Re-testing is included.
Is my code kept private?
Yes. An NDA is available on request, and your code copy is deleted 30 days after delivery.
What do you need from me?
Written authorization to test, plus access to the code and a staging copy (or we'll create one).