Your code.
Injection, cross-site scripting, unsafe file handling, weak password storage and the other flaws that lead to breaches, in JavaScript, Python, PHP, Java, Kotlin and C#.
Security readiness / for UK software companies
Find out what an attacker could do with your app, and fix it before it matters.
We review your code, dependencies, backend and public website, test whether one user can reach another's data, and write up what we find in a report your engineers can act on and your investors can read.
Booking opens soonRead a sample report →
Your code stays in your own CI. Every finding is reviewed by a person. Run by Amadis Consultancy Ltd.
Summary
Findings
Scope
Frameworks
Fixes
Approval
Findings
ILLUSTRATIVEAll 5Critical 2High 2Medium 0Low 1
Critical
One account can read another's allergy profileGET /api/profiles/{id}
APICritical
Log4j 2.14.1 allows remote code executionapi/pom.xml
CodeHigh
An API key is committed to the repositoryops/config/settings.py
SecretHigh
Search query built by string formattingreports/allergy_search.py
CodeLow
The deployment image runs as rootops/Dockerfile
ConfigWHEN TEAMS BOOK USBefore a funding round.Before a big customer contract.Before launching with personal or health data.
Coverage
What we check
Your dependencies.
Every library in your lockfiles, checked against the OSV and GitHub advisory databases. Anything on the US government's list of vulnerabilities being exploited right now goes to the top.
Secrets in your repositories.
API keys, tokens and passwords committed to your code. We record where each one is, never the value.
Your infrastructure files.
Dockerfiles, Compose and Terraform, for settings that hand an attacker more than they should get: privileged containers, an exposed Docker socket, services running as root.
Access control (add-on).
With two test accounts per role on your beta environment, we try to read, change and delete each other's data, endpoint by endpoint. A scanner can't find this. It takes two accounts and someone who knows where to look.
Backend and sign-in settings (add-on).
On a screen share, with you driving, we go through your Firebase or Supabase rules, sign-in methods, password policy, rate limits and token lifetimes.
Your public website (add-on).
Security headers, TLS, and files that should never be public, such as /.env and /.git. Passive checks only, at a rate you agree.
Your code, your systems
How we handle your code
- Your source code is not copied to us. The scan runs where your code already lives.
- People at Amadis review your results. No AI system is given your code, results or forms.
- Manual tests use test accounts on a beta or QA environment. Never production, never real users.
- At the end, we delete your data, or return it if you ask, and confirm it in writing.
Critical
One account can read another account's allergy profile
GET /api/profiles/{id} · ACCESS CONTROL
What we observed
Signed in as account B, changing the profile id in the request returned account A's profile.
Evidence
GET /api/profiles/1041 HTTP/1.1
Authorization: Bearer [redacted]
HTTP/1.1 200 OK
{"id": 1041, "owner": "veydr-test-a", ...}
Fix
Check on the server that the profile requested belongs to the signed-in account before returning it.
From booking to retest
How it works
Choose your assessment and pay online.
If we can't agree a scope, for example because your hosting provider doesn't allow testing, you get a full refund.
Sign the scope form.
It lists exactly which repositories, domains and environments we may test, when, and who to call to stop us. Nothing is tested before it's signed.
Add one workflow file to your CI.
The scan runs on your own runners with the network switched off. The only thing that leaves is a single encrypted file that only we can open.
We review every result by hand,
run the tests you bought, and rate each finding with a published method you can check.
You get the report and a 30-minute walk-through.
When you've fixed what matters, we retest and record which fixes we observed.
The deliverable
The report
Written for two readers. The first page tells a founder or board member what we found, what matters most and what to fix first. Everything after it gives your engineers the evidence, the impact and the fix for each finding.
Every severity is worked out the same way: a published CVSS score, adjusted by fixed rules for things like whether the system faces the internet or holds health data. The working is shown on each finding, so anyone can check it.
Findings are mapped to the OWASP Top 10 (2025), the OWASP API Security Top 10 and the OWASP Mobile Application Security Verification Standard, with a UK GDPR and data-security checklist. The report also says plainly what we did not look at, and how deeply we looked at the rest.
Read a sample report (PDF) →SECURITY READINESS ASSESSMENT
Security
Readiness
Assessment
Demo Allergy Diary
Sample report, synthetic test customer
Who it's for
When teams book us
Before a funding round.
Technical due diligence will ask about security. Arrive with an independent report and a plan you're already working through.
Before a big customer contract.
Security questionnaires ask for evidence of testing. A dated report, with retest results, answers most of them.
Before launching with personal or health data.
Access-control mistakes are cheap to fix in beta and expensive once real users are affected.
Fixed price
Pricing
Prices exclude VAT. You pay when you book. If the scope form can't be signed, we refund you in full.
Core assessment
Core assessment: £795
Code, dependency, secret and infrastructure checks in your CI; every finding reviewed by a person; the full report; a 30-minute walk-through; one retest after you've fixed things.
| Add-on | Price |
| Manual access-control test | £595 |
| Backend and sign-in review | £295 |
| Public website checks | £195 |
| Third-party SDK and mobile app inventory | £195 |
| Extra retest | £195 |
At checkout, Stripe asks you to accept our terms of service before you can pay.
Test mode: no real payment can be taken.
Honest limits
What Veydr isn't
It isn't a penetration test or an accreditation, and no assessment can promise you'll never be breached. A penetration test by a CREST-accredited firm goes further, and typically costs £2,500 or more. If your contract or investor asks for one, you'll need one. Veydr is the step before: it finds and fixes the common problems first, so a penetration test, if you need one, isn't spent on them. Every report says which you'd benefit from next.
Answers
Questions
Is this a penetration test?
No. It combines automated checks with manual testing of the areas scanners can't judge, but it doesn't attempt to break into your systems the way a penetration test does. The report says so on its first page.
Which languages do you cover?
Code checks cover JavaScript, Python, PHP, Java, Kotlin and C#. Dependency and secret checks cover every repository, whatever the language. Code in other languages, TypeScript and Go for example, is checked for dependencies and secrets but not yet read for code flaws, and the report says exactly which files each check read.
Do you need access to our code?
No. The scan runs in your own CI and sends us one encrypted file. For a manual access-control test we may ask for temporary read-only access, set out in the scope form and removed at the end.
Will you change our code?
No. We never push to your repositories. You get a fix for each finding and a ready-made Renovate configuration for dependency updates, and your developers make the changes through your usual review process.
How long does it take?
The report arrives within 10 working days of the later of your signed scope form and your first scan. The walk-through follows within a week.
Can we share the report?
Yes, with your board, investors, insurers, auditors and customers. Its first page says what it is and what it isn't, so it can't be mistaken for a certificate.
Book an assessment
Fix it before it matters.
From £795, fixed price.