Self-hosted server security review
You run your own server. We read its configuration and code and send back a written report of what to fix first.
fixed price, quoted before work starts
Fixed price, agreed after a short scope call.
What you send
- systemd unit files for the services you run
- your nginx (or other web server) configuration
- app code, as a repo invite or an archive
- a short note on what the server does and who uses it
No secrets. Strip passwords, API keys and private keys first. We do not need them and do not want them.
What you get
A written findings report. Each finding has a severity (high, medium, low or note), the file and line it refers to, what is wrong in plain words, and a specific fix. Findings are ordered with the most severe first. Typical areas: public endpoints that trigger costly work, sandbox settings that are looser than they need to be, secrets in logs or files with loose permissions, and places where one bug could reach other services.
The report ends with what we did not look at, so you know the limits.
Turnaround
Usually 3 to 5 working days after the scope call. The date is in the quote.
What it is not
- Not a penetration test, and not a test of anything you do not own.
- Not a guarantee that your server is secure.
- Not an install or a repair. We do not log in to your server or change it.
- Not legal or compliance advice.
How to order
Email us with the subject already filled in. We reply with a short scope call and a written quote. You pay by card after the scope call, not before.
Email us to order
Or write to hello@raidandev.org.
Frequently asked questions
Do I have to send passwords or API keys?
No, and please do not. Send unit files, web server config and code with secrets removed. If a file has a key in it, replace the value with a placeholder before sending. If we find one by accident we will tell you and delete our copy.
Do you change anything on my server?
No. The review is read-only. We read what you send and write the report. You decide which fixes to apply.
How long does it take?
Usually 3 to 5 working days after the scope call, depending on how much code there is. We give you a date when we quote.
Can you guarantee the server is secure afterwards?
No. A review finds problems in what we were shown, on the day we looked. It does not prove there are no others.
Will you test other people's systems or run attacks?
No. We do not run penetration tests, and we never test systems you do not own or run. Findings come from reading the files you send.