Security
Production hardening, not paperwork.
We run pen tests, review code, audit infrastructure, and respond to incidents. Written reports with reproduction steps — no PDFs full of false positives.
Security as standard
We secure what we ship — and what others have shipped.
Cybersecurity isn't a bolt-on. Our engineers review their own code the way auditors review yours. We also take engagements where we audit, harden, and respond on software we didn't write.
- Penetration testingWeb, mobile, and API. We hand you a written report with reproduction steps — not a PDF full of false positives.
- Secure code reviewLine-by-line review with Semgrep, CodeQL, and humans who read the framework — not just the diff.
- OWASP Top 10 hardeningAuth, injection, SSRF, deserialization, SSJI. Baseline defenses and regression tests so issues don't come back.
- Infrastructure auditsAWS, GCP, Kubernetes. IAM, network policy, secrets, and CI pipeline review with written remediation.
- Incident responseWhen something is actively wrong: triage, containment, forensic notes, and a post-incident writeup for your team.
- SOC 2 & ISO 27001 readinessControls mapping, evidence plumbing, and the engineering work that actually closes findings before your auditor arrives.
Responsible disclosure
Found something in our software? Tell us.
If you believe you have found a security vulnerability in any Leyecodes-operated service or in software we ship, we want to hear from you. We will acknowledge reports within one business day and coordinate a fix before any public write-up.
How to report
- Email security@leyecodes.com with a clear description and reproduction steps.
- If you need encryption, request our PGP key in your first message.
- Please do not test against production data belonging to our clients. Use synthetic accounts where possible.
What we commit to
- Acknowledge your report within one business day.
- Keep you updated while we triage and remediate.
- Credit you in any advisory we publish, unless you prefer to stay anonymous.
- Not pursue legal action against researchers acting in good faith within the boundaries of this policy.
Out of scope
- Automated scanner output without a working proof of concept.
- Denial-of-service, social engineering, and physical attacks.
- Clickjacking on pages with no sensitive state, and missing best-practice headers on static marketing routes.
Have a project in mind?
Tell us about it. We reply within one business day.
No templated proposals. No gatekeeping. Just a real reply from the team that would build it.