Popp MediaPopp Assurance · security
Security is a service category, not a checkbox.
Scans, then humans, then a retest. Twenty-five controls. Nothing critical open at launch.
Security coverageper project · in your portal
25 controls4 groups · threat model at design, scans at build, humans before launch, monitoring after
Pricefrom $500
Clears gateG10 · QA & security
StandardOWASP ASVS 5.0
Run byGUARD + Thomas
Twenty-five controls. Four groups.
From threat model to monitoring. Each one is a line on your project, checked and dated.
Architecture & preventive7GUARD · Design stage
Threat modeling and architecture review
HTTPS/TLS and secure DNS configuration
Security headers and Content Security Policy
MFA, least-privilege access and role permissions
Secure authentication, sessions and authorization
Secret management and secure API credentials
Data encryption and retention policies
Automated testing6PROOF · Build stage
SAST · static application security testing
DAST · dynamic application security testing
SCA · dependency and supply-chain scanning
Secret scanning across repositories
Container and infrastructure configuration scanning
Automated checks in continuous integration
Human verification6GUARD · Build stage
Manual penetration testing within written authorization
Authentication and authorization abuse testing
Business-logic vulnerability review
API security testing
File upload and form abuse testing
Retesting after vulnerability remediation
Operational protection6GUARD · Care stage
WAF and rate limiting where appropriate
Automated backups and recovery testing
Uptime and incident alerts
Audit logs and security-event monitoring
Incident response and disaster recovery plans
Periodic patching and security reassessment
The launch rule.
Launch ruleNo unresolved critical or high-risk exploitable finding goes live without a written, authorized risk decision. Higher-risk apps get independent manual testing.
OWASP ASVS 5.0The verification standard we test against. Depth matches the risk: a brochure site is not a customer portal.
Scans, then humans, then a retestAutomated tools find the easy ones. GUARD tests auth, logic, uploads and APIs by hand. Fixes get retested.
Written authorizationEvery penetration test runs inside a signed scope. Nothing adversarial without your name on it.
No test can guarantee a website is invulnerableSo monitoring, backups and an incident plan are part of the service, not an add-on.
How it runs.
GUARDSAST, DAST, SCA, secret scanstep 1 GUARDManual testing · auth, logic, uploads, APIstep 2
FLOWRemediationstep 3 GUARDRetest · evidencestep 4T ThomasRisk decision on anything leftstep 5
Application Security Assessment · from $50025 controls · OWASP ASVS 5.0 · G10
Get back to the work.
Live demo
Peek inside a client portal.
Sunny Side Pools is made up. It is the real portal — look around; nothing you click is saved.