A government website, checked before anyone could log in.
A NSW Government department asked us to security-test its new public website before launch. We tested the public site, the user portal and the admin system, retested every fix and signed off with a security attestation.
Test it, fix it, prove it.
- 1SCOPE
Three parts, one launch
The department was launching a new public-facing website. Behind it sat a user portal and an admin system. All three were in scope because a weakness in any one of them is a weakness in the whole site.
- 2TESTING
Hands-on testing plus a code review
We tested the running system the way an attacker would approach it. We also reviewed the source code, which finds problems that testing from the outside can miss.
- 3RETEST
Every fix checked again
Findings went back to the developers with plain explanations. Once they were fixed we retested each one rather than taking the fix on trust.
- 4SIGN-OFF
Attestation before go-live
With every fix confirmed we signed off with a security attestation, so the department could launch knowing the site had been independently checked.
Why it matters for your software
The same process applies to software built for a small business, including software written with AI tools. AI-written code often works on the first try and still has gaps in who can see what. Finding those before launch costs far less than finding them after.
Read about our AI App Security testing or how we're using OpenAI Daybreak Blue in our security work.
Launching something soon?
Tell us what you're building and when it goes live. We'll tell you what a pre-launch review would cover.