Handoff Security / BUSINESS SECURITY
Website security testing for Hong Kong SMEs
Understand risks in customer accounts, bookings and data access before launch or after a major change.
Security testing from HK$7,800
Is this suitable for my website?
Customer portals, booking systems and websites with different user roles can benefit from focused targeted checks. A simple information website may need a narrower assessment. Tell us what your website does before choosing a service.
What do we check?
We agree the workflows, accounts and data access boundaries to examine. Security testing asks whether a user can view another customer’s records or perform an action they should not be allowed to perform. Testing covers only the agreed scope.
Example: a customer changes another booking
In a fictional booking website, a signed-in customer should be able to change only their own booking. Within an authorised test scope, we follow the booking journey using separate test accounts to check whether another customer’s record can be viewed or changed. This examines the whole agreed journey, not just the appearance of the page.
What will my developer receive?
A report explains what was checked, the impact of verified findings and practical repair guidance. Your developer implements fixes. Any included retest covers original findings within the agreed limits.
What is excluded?
Third-party platforms are not automatically included. Complex payments, uploads and multi-company data separation may require separate scoping. This is not a guarantee of complete security or a compliance certificate.
What we check
- Starting scope
- 1 app · Up to 2 workflows / 2 roles / 6 API endpoints
- What you receive
- Verified findings, business impact and practical repair guidance for your developer. Code changes are excluded.
- Walkthrough and retest
- One online walkthrough up to 30 minutes. One retest of original findings within 30 days after the report, up to 2 hours. Extra work agreed separately.
All limits apply together. Extra workflows, roles or endpoints need separate agreement; third-party systems are not automatically included.
Starting prices cover limited scopes. Scope confirmation precedes a fixed quote. Fees cover agreed work and deliverables, not findings; vulnerabilities and complete security are not guaranteed.
100% payment and written testing authorisation are required before testing begins. Before payment, the fixed quote sets out scope, deliverables, exclusions, fees, testing dates and expected delivery timing.
Full scope, exclusions and engagement termsLet’s start with your website.
No technical knowledge needed.
Enquire about my websiteExclude passwords, tokens, customer data, private links and sensitive screenshots.