Security review
$522
fixed · 5 working days
- one existing app, one environment
- 8 areas, source access
- findings ranked by severity
- 30-minute walkthrough call
Replies within one working day
Book a callLab · the craft behind this site
If my own site is this good, yours will be too.
Four things you can touch: a sculpture of the monogram, a live check of this site's own security headers, the grid under a real screen, and the particle stream with its knobs exposed. Nothing here is a mock-up.
one live canvas at a time · paused when off screen · readable with motion reduced
the Alythen A
A monogram you can turn.
Two machined beams meeting at the apex, the attack line breaking out through the right leg. Built as editable geometry from the same paths the logo uses — no model file — lit by a small studio, with the lime only in the bar and the rim.
Drag to turn · arrow keys with the sculpture focused · the light follows your pointer
Procedural three.js geometry in src/views/lab/sculpture-scene.ts — every colour and number is a CONFIG knob.
how this site is built
The same treatment your site gets.
Everything below is checkable: the headers are fetched live from this site, the scores are from the same public tools anyone can run. Lab numbers are labelled as lab numbers.
Lineage. The page composition and motion are GetLayers' Relay template, re-skinned: the skin, copy and tokens are Alythen's, the choreography is the template's, preserved on purpose. The particle stream that threads the homepage is the one live canvas there.
The loader gate. The preloader plays once per browser session on desktop; phones, repeat visits, crawlers and anyone with motion reduced get the page at once. Every block below the fold hydrates as it nears the viewport, not at load.
Rendering and the policy. Every page is rendered per request so it can carry a per-request nonce: scripts run only with that nonce, nothing inline is trusted by default, framing is refused, and the browser is told to upgrade every request. The panel on the right reads the live answer.
live · this site's response headers
Fetching this site's own headers…
Your site gets the same treatment.
measured — live where it says live, lab where it says lab
- A+
securityheaders.com grade, checked live after launch (2026-09-28)
- 80
Lighthouse mobile performance on / — lab number, real-user path, production build
- 100
Lighthouse accessibility and SEO on every indexed page — lab numbers
- 0
known vulnerabilities in dependencies at launch (yarn audit)
design / structure
The grid under a real screen.
This is the pricing section of this site, as shipped. Flip the switch to see what it stands on: the page column, the spacing rules, and the boundary of every component. Two lines, so you know what you're looking at.
- 01Every screen on this site sits on one column with fixed insets, and every distance between things is a token, not a guess.
- 02Each outlined box is one component with its own file, props and motion — the pieces a change is made in.
pricing
Prices, in writing, before you ask.
Also: Websites from ~$900 · AI security review ~$900 · Automate from ~$1200 · pentests quoted in writing. Prices published in INR, shown in USD, exclusive of taxes.
Build
$1,570
from · 4–8 weeks
- discovery, custom design, build
- pre-launch security review included
- source and accounts you own
- 30 days of in-scope fixes
Build + pentest
$2,610
from · 6–10 weeks
most picked
- everything in Build
- full manual pentest of app and API
- report in the public sample format
- one retest within 30 days
tune the stream
The same system that threads the homepage.
A smaller instance of the homepage's particle stream, live, with a safe subset of its knobs. It mounts only while this panel is on screen, so this page never runs two canvases at once.
the point of all this
Want this level of craft on your site?
Websites from ~$900, designed, built and security-tested by the same person. Or write a few lines and I'll tell you what it would take.