// 09 BUILD
Custom Software Development
Web apps, dashboards, portals and APIs built with secure coding practices.
Web apps, dashboards, portals and APIs built with secure coding practices, code review and pre-launch penetration testing included.
What's included
- Web apps, dashboards, portals and APIs
- Secure coding practices throughout
- Code review
- Pre-launch penetration testing
Our methodology
- 1Secure design first: data flows, authentication and access control are designed before the first line of code, not retrofitted.
- 2Secure coding throughout: input validation, safe authentication, least-privilege access and dependency review applied as standard practice during the build.
- 3Ongoing code review: changes are reviewed for common vulnerability classes such as injection, broken access control and exposed secrets as the project progresses.
- 4Pre-launch penetration test: the finished application gets a real penetration test before it goes live, not just a code review.
What you get
- Production-ready application
- Code review report
- Pre-launch penetration test report
What to expect
- A production-ready application built to handle sensitive data responsibly from day one.
- A code review report and pre-launch penetration test report you can share with clients or investors.
- Fewer expensive security retrofits later, because the risk was designed out early.
Limitations
Honest scope, not a sales pitch — here's what this service doesn't cover.
- Security depends on the scope and requirements agreed at the start; features added after launch should go through the same review process.
- The pre-launch penetration test covers the application as built; ongoing changes need their own testing before major releases.
- We build the application and review its security; formal compliance certification such as SOC 2 or ISO 27001 is a separate process — see Compliance & Risk Assessment.
FAQ
Do you build the whole application or just review our developers' code?
Both are available — full-build engagements include our own development team; code-review-only engagements work alongside your existing developers.
What happens if the pre-launch pentest finds issues?
We fix what we find as part of the same engagement before launch — that's built into the process, not a separate cost.
What tech stack do you use?
We scope the stack to the project rather than forcing one, and we're happy to work within a stack you've already chosen if it's a reasonable fit.
// PROCESS
How this engagement works
- // 01
Free consultation
30 minutes to understand your setup and concerns.
- // 02
Scoped proposal
Fixed scope, fixed price, clear timeline. NDA signed before any access.
- // 03
Build & review
We build with secure coding practices and review the code as we go.
- // 04
Test & launch
Pre-launch penetration test, then handover and launch.
Authorisation & safety
Every engagement starts with a signed NDA before we get access to your systems or data. We follow secure coding and data-handling practices throughout, and any security testing of what we build — code review, pre-launch penetration testing — is scoped and agreed with you in advance.
// FROM THE BLOG
Further reading
Software Supply Chain Attacks: Lessons from the 2026 npm Compromises
A widely-used npm package with over 100 million weekly downloads was hijacked in 2026 through a single compromised maintainer account. Here is what happened and what it means for any business relying on open-source software.
Software Supply Chain Security: How Third-Party Dependencies Become Attack Paths
Third-party and supply-chain breaches rose sharply in 2026, now representing nearly half of all incidents analyzed by Verizon. Here is where dependency risk actually enters your environment, and what to do about it.
Ready to talk through your scope?
Book a free consultation. No obligation, no pressure.
