A website that gets attacked before it gets launched.
Marketing sites and landing pages for funded startups: designed and built by me, with custom motion, delivered with the same pre-launch security review as every build — and the source is yours.
up to ~6 pages · CMS optional · custom motion included · fixed price
You've raised, or you're about to, and the site has to hold up in front of customers, candidates and the next investor: one page or six, with a story, real motion, and a form that actually reaches you.
You'd rather pay one person to design it, build it and then try to break it than coordinate an agency, a developer and — usually never — a security check. This site is the example: it runs the same review, and its headers, speed and code are all public.
what a website includes
Designed, built, attacked, handed over.
Every website, at every price, goes through all of this. Larger sites — more pages, a shop, accounts — are quoted in writing.
001
Design
A visual system drawn for your company, not a theme: type, colour, layout and the motion that goes with them, at desktop and phone sizes. You see it in the browser, not in a slide deck.
week one
002
Build
Up to about six pages on a fast, current stack, with custom motion, the forms you need, analytics that doesn't need a cookie banner, and search-engine basics done properly: titles, previews, sitemap, structured data.
weeks two and three
003
CMS, if you want one
If you'll edit copy, posts or case studies yourself, I wire a content editor in. If you won't, I don't — the site stays simpler and faster.
optional, decided on the call
004
The attack
Before launch I run the same pre-launch security review I sell on its own: headers and browser protections, forms, any login or admin surface, third-party scripts, exposed keys. Findings in writing, fixed before launch.
the final days, never cut
005
Launch and handover
On your domain and hosting accounts, in your name. The source in an account you own, written notes on how to change things, and a call.
you own everything on day one
security, on a website
“It's just a marketing site” is how it starts.
A website is the front door: the thing on your domain, in your email, in front of every prospect. It gets the same care as an application.
01
Browser-level protections from the first deployment
The set of response headers this site scores A+ on, so a hijacked script or an embedded frame can't turn your site against your visitors.
02
Forms that reach you and nobody else
Validated on the server, rate-limited, with a honeypot — and they never say “sent” unless the message arrived.
03
Third-party scripts kept to what you actually use
Every tag and widget is a way in. Each one is listed, justified and allowed explicitly.
04
No keys or passwords in the code
Checked across the whole history of the code, with a check that keeps it that way.
05
Your domain, not just your site
Email spoofing protection (SPF, DKIM, DMARC) checked and set, so nobody can send mail as you.
06
Fast on a phone, measured
Speed is checked with the same public tools anyone can run, before launch and after.
what you receive
A finding, as it arrives.
Every finding in a report says what the issue is, what an attacker gains, exactly how to reproduce it, and how to fix it — ranked by real-world impact, never a scanner result passed through. This one is from the public sample; the whole 12-page report is linked under it.
IDOR on order endpoint exposes any customer's orders
Order API · CWE-639 · OWASP API1:2023
What the issue is
GET /v2/orders/{orderId} verifies that the caller is authenticated but never checks that the order belongs to them. Order IDs are sequential integers, so the entire order table can be walked by incrementing a number.
What an attacker gains
Any authenticated customer can read every order in the system: line items, totals, delivery addresses, phone numbers and email addresses. For a retailer this is a personal-data breach affecting the whole customer base, reachable from a free signup.
Reproduction
# authenticated as customer A (own order)
GET /v2/orders/10442 → 200 OK // expected
# same session, another customer's order
GET /v2/orders/10441 → 200 OK
{"orderId":10441,"customer":{"name":"[REDACTED]", …
A short script walking IDs 10000–10500 returned 500 of 501 records. Enumeration was stopped at that point and no data was retained; the redactions above are applied at capture.
How to fix it
Enforce ownership server-side on every object access — the query itself should be scoped to the caller, not filtered afterwards. Replace sequential identifiers with UUIDs so that enumeration is not trivially possible even if a check is missed in future.
-- scope the query, do not check after fetching
SELECT * FROM orders WHERE id = $1 AND customer_id = $2;
Add an automated test asserting that customer A receives 404 for customer B's order. This class of bug returns whenever a new endpoint is added, so the guard needs to be a test, not a code review habit.
Sample report · fictional target · every finding, payload and identifier in it is synthetic. Real reports go to the client and nowhere else.
timeline and price — fixed, agreed in writing before work starts
9000
USD, from · about · ₹75,000
30
to 4 weeks, from the first call to launch
60
pages, about — larger sites are quoted in writing
30 days0 days
of in-scope fixes after launch
Payment is 50% to start, 50% at launch. Published in Indian rupees; the dollar figure is today's conversion.
the scope boundary
Up to about six pages. More is a quote, not a surprise.
The price covers a marketing site or landing page of up to about six pages, with custom motion, the forms you need and an optional content editor. A shop, customer accounts, a dashboard, a large content library or a site in several languages is a larger job — scoped and priced in writing, the same way as everything else here.
If what you're building has users who log in and data they trust you with, it's an application, not a website: see Build. If you already have a site and only want it checked, see Review.
before you start
Questions people actually ask.
What does a website cost?+
From ₹75,000 (about $900) for up to about six pages, fixed price, agreed in writing before work starts. Payment is 50% to start, 50% at launch. Larger sites are quoted in writing.
How long does it take?+
Three to four weeks from the first call to launch, depending on how quickly you can give feedback on the design and supply the content.
Do I get a CMS?+
If you want one. If you'll edit copy, posts or case studies yourself, I wire a content editor in. If you won't, the site stays simpler and faster without it.
Can you use my existing brand and content?+
Yes. Bring a logo, colours, copy or a deck, and the design starts from there. If there's nothing yet, that's fine too — the first week covers it.
Who owns it?+
You do. The site runs on your domain and hosting accounts, in your name, and the source lives in an account you own. If we part ways, everything stays with you.
Why is there a security review on a marketing site?+
Because it's the thing on your domain, in your email, in front of every prospect. Headers, forms, third-party scripts, exposed keys and email spoofing are where marketing sites get hurt, and they take days to check properly — so they're checked.
start a website
Tell me what the site has to do.
Who it's for, what it has to say, and when you need it live. I reply within one working day; the first call is a free 15 minutes.
