Discuss a project
+7 (812) 507-81-30 hello@rupor.agency
Security

Code security audit for e-commerce and online services

We find the flaws, fix them, and check again. A review of the code, configuration, and business logic of your website, customer account area, or app — with no attacks on the live service.

Discuss your task Sample finding

We answer four questions about your website, customer account area or app

  1. 01

    Can an outsider log in to someone else’s account?

  2. 02

    Can someone see other people’s orders, addresses, and phone numbers?

  3. 03

    Can someone skip paying, use a promo code ten times, or get a gift without meeting the conditions?

  4. 04

    Can someone get to your passwords, keys, and admin panel?

To answer them, we look at your service from the inside: we read the code and check the configuration, role permissions, and how keys and personal data are stored. We find the weak spots, explain what they mean for the business, fix them — with your team or ours — and check again. We work with the code and a test environment: we do not attack the live service.

Why this matters beyond security

  • Your site can go down in the middle of a sale
  • Your customers can receive mass emails sent in your name
  • Someone can order for free for weeks through a payment bug
  • A personal data leak means a fine and an inspection by Roskomnadzor (Russia’s data protection authority)

Why now

64%

of web applications had high-risk vulnerabilities in 2025

Positive Technologies, “Cyberthreats to web applications: trends for 2026–2027”

51%

of the vulnerabilities found are access control flaws: one user can see or change another user’s data

Positive Technologies, projects from 2025 to Q1 2026

42 days

on average, an attacker stays undetected inside a company (25 days in 2024)

BI.ZONE DFIR, December 2025

₽11.5M

average loss from a data leak

InfoWatch / BISA, January 2025

Fines for personal data leaks in Russia since May 30, 2025

Federal Law No. 420-FZ, Article 13.11 of the Russian Code of Administrative Offenses

Scale of the leakFine for the company
1,000–10,000 people₽3M–₽5M
10,000–100,000 people₽5M–₽10M
Over 100,000 people₽10M–₽15M
Repeat leakTurnover-based fine: 1–3% of revenue, no less than ₽20M and no more than ₽500M

A leak must be reported to Roskomnadzor within 24 hours of discovery, and the results of the investigation within 72 hours. For large businesses, the main risk is a turnover-based fine for a repeat leak, plus service downtime; for mid-sized businesses, it is the very first leak, with fines from ₽3M.

How we are different

We’re developers

We understand how your service works, speak your team’s language, and can fix what we find ourselves.

We confirm every finding manually

The report includes only what an engineer has verified personally: reproduced in a test environment or confirmed through the code, configuration, and server logs.

Recheck in the Full audit and higher packages

On real projects, we have seen a fix close one path to a flaw while an adjacent path stays open. So after the fixes, we check again, including adjacent paths.

Transparent fixes

If we do the fixes, the changes arrive in your repository as a pull request with a description and an automated test, and your team decides on the rollout. The recheck is a separate pass through the checklist of findings.

A report for two audiences

Management gets the risks in business terms; developers get the exact location, steps to reproduce, and a ready-made fix.

What we check

Account takeover

Login, verification codes, sessions and token lifetimes, account recovery.

Other users’ data

Object owner checks in every request, role-based access control.

Money

Payments, promo codes, gifts, bonuses, concurrent requests during payment.

Unsafe input

Injection into database and server queries, file uploads, requests to internal addresses.

Keys and passwords

Secrets in code, logs, and configuration; encryption of payment keys.

Server configuration

Debug mode, security headers, CORS, exposed panels and service URLs.

Libraries

Dependencies with known vulnerabilities, verified against primary sources.

Admin panel and integrations

Staff permissions, webhooks, payment and accounting systems.

What’s visible from the outside

Domains and addresses from your list: what public sources reveal about them, with no scanning.

Personal data

Where it is stored, who can see it, and what ends up in logs.

Standards and scope

We check our coverage against OWASP ASVS (we choose the level together with you) and the OWASP API Security Top 10. We rate severity using CVSS 3.1 and business impact: next to each technical score, there is a “what the company stands to lose” scenario. We work only on the domains and systems you have listed and confirmed in writing. No scanning and no active testing. We do not download or process leaked databases.

Case studies

An outsider was already inside

Challenge
Code and server review for several related websites.
What we did
We checked what was visible from the outside and went through the code, modules, and server configuration.
Results
We found signs of compromise: a backdoor giving an attacker hidden access was running on the server. The way in was a module that had not been updated in a long time. With the client’s written approval, we extended the scope to neighboring sites on the same server.
What it meant for the business
The attacker could have replaced the sites’ content at any moment or used the sites to attack visitors.

Account takeover and orders without payment

Challenge
Full audit of code and infrastructure.
What we did
Area-by-area review, confirmation of every finding, fixes, and a second pass.
Results
We found ways to log in to someone else’s account and to bypass payment. The second pass showed that some of the first fixes closed one path to the flaw while an adjacent one remained open. The fixes passed a recheck on a staging environment.
What it meant for the business
The flaws we found made it possible to get orders without paying and to log in to other people’s accounts.

Case studies are anonymized. We can tell you more on a call, under NDA.

What you get

  1. Executive summary

    1–2 pages: the overall security level, the main risks in business terms, and what to do first.

  2. Technical report

    For each finding: severity, location in the code or system, steps to reproduce in a test environment, and a fix recommendation. A separate section covers what was checked, what was left out of scope, and why.

  3. Remediation plan

    Prioritized, with effort estimates: what to fix today, this week, and this month.

  4. Debrief meeting

    With your management and developers.

  5. Recheck report

    With a list of closed items — in the formats that include a recheck.

  6. Optional

    Export of findings to your issue tracker and an automated test for each fixed flaw.

A sample finding card from the report
High

A user can open someone else’s order by putting its number in the request.

Where
The order retrieval endpoint; the server does not check who owns the order.
Impact
Access to customers’ addresses and phone numbers, which are personal data under 152-FZ (Russia’s personal data law).
Steps in a test environment
A request made under account A for user B’s order returns that order’s data.
How to fix
Check the order’s owner on the server; add an automated test.

How the work goes

  1. 1

    Agreement 1–2 days

    Contract, mutual NDA, a written list of systems and boundaries, contacts on both sides.

  2. 2

    Review timeline depends on the format

    We look at what is visible from the outside for everything on your list, decide together what is critical for you — money, customer data, trust, business continuity — and go through the code, configuration, and business logic. We confirm every finding manually.

  3. 3

    Report and meeting 1 day

    We go over the results with your management and developers: what to fix today, this week, and this month.

  4. 4

    Fixes and recheck 2–5 days for the recheck

    Your team makes the fixes, or we do, as a pull request to your repository. Then we confirm the fix and check adjacent paths to the same flaw.

Urgent findings

If we find a critical issue or signs that an outsider is already active in your service, we notify your contact person within one business day of confirming it — right away, without waiting for the final report. If there are signs of compromise, we stop the review and agree on next steps to preserve evidence for the investigation.

What we need from you

A list of services and domains, test environment accounts for every role, access to the source code (for a full audit), and a contact person on the development side.

Was the site built by another contractor? We will arrange access with them ourselves.

No test environment? We will tell you how to set one up, or do a limited review of the code and configuration.

Formats and pricing

Express audit

A website or online store: you need to know whether everything is in order.

Timeline: 5–7 business days

  • What’s visible from the outside
  • Configuration and secrets
  • Review of key code modules
  • Critical scenarios involving money and business logic
  • Report and remediation plan
Discuss

Full audit

Your own customer account area, app, couriers, API.

Timeline: 2–3 weeks

  • What’s visible from the outside
  • Configuration and secrets
  • Review of the entire codebase
  • All scenarios involving money and business logic
  • Report and remediation plan
  • Recheck within 60 days
Discuss

Turnkey

You have no in-house developers, or they are busy.

Timeline: 3–5 weeks

  • Everything in the Full audit
  • Code fixes by our team
  • Recheck included
Discuss

Ongoing audit

Frequent releases.

Timeline: monthly or quarterly

  • What’s visible from the outside
  • Configuration and secrets
  • Review of changes over the period
  • New business logic scenarios
  • Report and remediation plan
  • Recheck
  • Fixes by agreement
Discuss

Cost and timeline are calculated individually

No two projects are alike. The scope of the audit and fixes depends on the system’s complexity, the size of the codebase, the number of integrations, and much that only becomes clear during the review. That is why we give an exact estimate after getting to know your project.

FAQ

We already have a vulnerability scanner. Why an audit?

A scanner finds known vulnerabilities by their signatures. According to Positive Technologies, about half of the vulnerabilities found in web applications are access control flaws; alongside them are business logic flaws: someone else’s order, a reused promo code, a payment bypass. Finding them takes an engineer who has figured out how your service works.

We have a strong development team. Why an external audit?

That’s why the report is written for them: the exact location, the steps, a ready-made fix. An outside view catches what the team’s eyes have grown used to.

Do we have to buy the fixes from you?

No. The report is yours, and any developer can make the fixes based on it.

What if you find nothing serious?

You get a report listing what was checked. That is a result too: you know what has been checked and where the risk is low.

Will this replace the check a regulator requires?

No. Regulatory testing, GOST R 57580 assessments (the Russian security standard for financial institutions), and critical information infrastructure work are the job of a contractor licensed by FSTEC (Russia’s Federal Service for Technical and Export Control). We can help prepare your code and configuration for such a check.

Do we need this if we’ve had no leaks?

On average, an attacker stays undetected for 42 days (BI.ZONE). The absence of known incidents doesn’t mean there haven’t been any.

Do you send our code to external services?

Only with your written permission, naming the provider, its jurisdiction, and the retention period. Before any transfer, the code goes through an automated check for secrets and personal data, and anything found is left out. We set this arrangement in the contract before we start; we can also work with local tools only — in that case, we recalculate the timeline and cost.
Next step

Tell us about your service

  1. A 30-minute call: we get to know your service and what is critical for you.
  2. A short questionnaire and an estimate within two business days.
  3. Contract, NDA, kickoff.
+7 (812) 507-81-30 hello@rupor.agency

Don’t send passwords, keys or credentials through this form: we’ll agree on a secure handover after signing an NDA.

Request sent!

We’ll get in touch to schedule a call

Related services

152-FZ

152-FZ compliance

We make websites technically compliant with 152-FZ (Russia’s personal data law) and Roskomnadzor requirements: consents, cookie banner, tracker blocking.

 E-commerce

Online store development

Online stores on WooCommerce and Laravel: from quick launches to high-load platforms.