WORK
The proof we can publish.
No client logos yet. What we can put in front of you: the report template, six findings from a redacted review, three lab engagements and the list of files every engagement ships.
The deliverable
The sample is the product.
Every engagement ends with this document. The six findings below are from a redacted review; the structure does not change with the size of the project.
- A reproduction note for each finding, so your developer can watch it fail
- Business impact in your terms, with CVSS as a column rather than the conclusion
- A named owner and an effort estimate for every fix
- A retest result recorded in the same file before it is closed
Redacted means no client name, hostname or data appears in it. It is a document you can read before you buy anything.
Secure and SameSiteHigh6 findings · one template · retest included
Reference engagements
Three site engagements, timed end to end.
Each one ran on infrastructure we own, against a working site rather than a slide deck. Read them as evidence of method, not as client work.
Reference engagement
Lab environment
WooCommerce store, three sites, 14 plugins
Problem. Plugin versions had drifted across three sites, and the nightly backups had never been restored. A failed update would have taken the store down with no verified way back.
Delivered
- Hardening pass across all three sites
- Restore test from a production backup
- 90-day patch and update plan
Duration · 9 days
Reference engagement
Lab environment
Brand site rebuild and host migration
Problem. A 12-page site built on a retired page builder, with no staging copy and URLs that had ranked for three years. Moving hosts without a redirect map would have erased the traffic.
Delivered
- Rebuild on WordPress with the old URL map
- 301 redirects and DNS cutover with rollback
- Crawl check before and after launch
Duration · 12 days
Reference engagement
Lab environment
Hacked WooCommerce store recovery
Problem. A card-skimming script on checkout, a Google safe-browsing warning and a host that had already suspended the account. The owner had backups on the same server.
Delivered
- Site isolated, payload removed, credentials rotated
- Entry point identified and patched
- Search Console recovery and 30-day watch
Duration · 4 days
Durations are working days. The 5-day and 7-day scopes match the Security Baseline Review and the AI Application Security Review; the 9-day WooCommerce scope is a custom engagement. No client data, production access or recognizable name is involved.
Deliverables
What ships, and on which day.
The same six files close every assessment. A build swaps the findings file for a handover pack, and the dates move with the scope.
| File | What is in it | When |
|---|---|---|
| scope.md | Assets, time window, exclusions and the named people who signed off | Before work starts |
| exposure-inventory.csv | Domains, subdomains, exposed services and TLS status | Day 3 |
| findings.pdf | Reproduction, business impact, fix, owner, effort and severity | Day 5 |
| 90-day-roadmap.md | Now, next and later, with effort estimates and dependencies | Day 5 |
| retest.md | What closed, what did not, and the evidence for both | Within 30 days |
| close-out.pdf | One page stating what was tested and what remains open — forwardable to a customer | Within 30 days |
A retainer replaces the last two files with a monthly report and a change log. Nothing is delivered as a dashboard you have to interpret.
Publication rule
What will never appear on this page.
Three things, each for its own reason.
- Client logos. Not one appears here. Paying an invoice does not imply permission.
- Testimonials. A friendly quote still needs written permission, so we point you at the report instead.
- Invented metrics. No percentage of findings fixed, no average response time from a sample too small to average.
When a client does allow publication, the case study will state the assets tested, the dates, the findings that were fixed and the ones that were accepted — nothing beyond that.
Next step
Start with the document, not the pitch.
Send one paragraph about the system and the deadline. You will get the redacted sample and a written answer within one business day.