Secrets in the wrong places
API keys and database passwords committed to the repository, pasted into chat or kept in a spreadsheet, and never rotated after people leave.
Software security services
Software Security Services for UK Product Teams
Find and fix the weaknesses in your web apps, APIs and mobile back ends — from threat modelling and code review to clearing a pen-test report — with engineers who change the code, not just write up the findings.
- Findings fixed in your code, not just reported
- Independent pen testing recommended, not replaced
- Honest evidence for questionnaires and audits
Where software security breaks down
Many breaches start with ordinary mistakes.
Not exotic attacks. Usually a missing authorisation check, an outdated library, a leaked key or an admin panel left open — the kind of thing a routine review catches.
What good security practice looks like
Routine and built into delivery, rather than bolted on before an audit:
- Threats considered while features are designed
- Code and dependencies scanned on every change
- Secrets kept in a managed vault and rotated
- Independent testing, with the findings actually fixed
- Evidence kept ready for customers and insurers
Broken access control
A customer who can see someone else’s invoice by changing a number in the URL, or an admin endpoint that checks you are logged in but not who you are.
Outdated dependencies
A long tail of open-source packages, some with published vulnerabilities, and no routine for knowing which ones matter or updating them safely.
Pen-test reports left unread
A report full of findings nobody has the time or context to fix, so the same issues come back at next year’s test.
What we do
Security work that changes the code.
We are software engineers who make applications harder to break. We work alongside independent testers and your compliance advisers, not instead of them.
Threat modelling
A structured look at what an attacker would want from your system and how they might get it, done at design time when fixes cost least.
Discuss this
Code and dependency scanning
Static analysis, dependency and secret scanning wired into your CI pipeline, tuned so real issues surface and the noise does not.
Learn more
OWASP Top 10 remediation
Injection, broken access control, insecure design and the rest of the OWASP Top 10 found in your code and fixed, with tests so they stay fixed.
Learn more
Authentication and authorisation reviews
Login, sessions, password reset, MFA, roles and tenant isolation checked end to end — the places where small mistakes expose the most data.
Learn more
Secrets management and hardening
Keys moved into a secrets manager and rotated, security headers and TLS configured properly, and cloud permissions cut back to least privilege.
Learn more
Pen-test remediation and evidence
Findings from independent testers fixed and prepared for retest, plus technical evidence for Cyber Essentials and customer security questionnaires.
Learn more
How we work
From first review to fixes that stay fixed.
Security work follows the same seven stages as any build. What changes is what we look for at each one — and every finding ends in a code change, a test or a documented decision.
- 01
Discovery
We learn what the system does, what data it holds, who uses it and what you are obliged to protect — customer contracts, UK GDPR, insurer or procurement requirements.
Scope, data map and obligations
- 02
Strategy
We agree the review scope, what is out of bounds, and whether an independent pen test should come before or after our work — then fix a price.
An agreed scope and plan
- 03
UX & architecture
Threat modelling of the architecture and key user journeys: trust boundaries, sensitive data flows and the abuse cases a normal test plan would miss.
A threat model with ranked risks
- 04
Development
Fixes delivered in sprints, highest risk first, each through code review with a test that reproduces the issue and proves it is closed.
Fixed code with regression tests
- 05
Testing
Scanners and targeted checks re-run against staging, then support for the independent tester’s retest where one is part of the plan.
Verified fixes and retest support
- 06
Launch
Scanning and secret detection left running in your pipeline, with security headers, logging and alerting in place in production.
Security checks built into delivery
- 07
Optimisation & support
Dependency updates, new advisories triaged as they appear, and a periodic review as the application changes, so security does not decay between tests.
Ongoing security maintenance
Technology
Standards and tools we work with.
Recognised standards as checklists, automated scanning as a safety net, and engineers reading the code for the problems scanners cannot see.
Standards and guidance
OWASP Top 10OWASP ASVSNCSC guidanceUK GDPR security principle
Scanning in CI
Static code analysisDependency scanningSecret scanningContainer image scanning
Identity and access
OAuth 2.0 and OpenID ConnectMulti-factor authenticationRole-based access controlSession management
Secrets and data
Secrets managersKey rotationEncryption at rest and in transitPersonal data minimisation
Web and API hardening
Security headers and CSPTLS configurationRate limitingInput validation
Stacks we secure
Node.js and TypeScriptPythonPHP and LaravelJava, .NET and Go
We are not a penetration testing firm and we do not certify anything. For independent testing, use a CREST-accredited provider; we will fix what they find and prepare for the retest.
Use cases
When UK teams call us about security.
Usually one of these moments — each with a specific deliverable at the end.
Answering a security questionnaire
A prospective customer’s questionnaire answered accurately, with the gaps it exposes fixed first rather than glossed over.
Clearing the findings
Every finding triaged, then fixed in code or formally accepted with a reason, and the application made ready for the independent tester’s retest.
Technical evidence for the assessment
Patching, secure configuration, admin access and MFA on cloud services checked and documented for the parts of scope that cover your software.
A security health check
An app built by a previous supplier reviewed for dependencies, secrets, access control and data exposure, with a ranked list of what to fix first.
Security by design for new builds
Threat modelling and secure defaults from the first sprint, with documentation that supports your DSPT, PCI DSS scope or FCA operational resilience work.
Root cause and hardening
After a suspected breach or near miss, we trace how it happened, close the gap and add the logging you will need next time, while you handle the ICO notification decision.
Relevant work
Products we have designed and built.
A selection of client projects related to this work. Each case study covers the brief, the approach and the stack.
All case studiesLegal · SaaS
CO-LAW Group
Client intake, risk checks and document workflows for a boutique law firm.
Next.jsPostgreSQLAWSStripe
Read the case studyHealthcare · Web
Tekish Health
Telemedicine web platform: booking, video consultations and patient records.
Next.jsWebRTCFHIRAWS
Read the case studyFintech · Payments
e-Wallet
Multi-bank digital wallet with transfers, analytics and virtual cards.
React NativeNode.jsStripePostgreSQL
Read the case studyWhy Techsleight
What working with us is actually like.
No inflated numbers — just how we run projects, and what you can hold us to.
Product engineering, not ticket-taking
We ask what the software is for before we estimate it — and we will tell you when something should not be built, or should be bought instead.
AI where it earns its place
LLM features, retrieval and automation built with evaluation, guardrails and cost controls, and plain software where that is the better answer.
Full-stack under one roof
Design, frontend, backend, mobile, cloud and QA in one team, so nothing falls between suppliers.
UK-focused delivery
UK business hours, estimates in pounds, and a contract with a UK company. Our engineers are based in the UK and India.
Flexible engagement
A fixed-scope project, dedicated developers or a monthly retainer — and you can move between them as the work changes.
You own everything
Code, IP, cloud accounts and documentation are yours from day one. We sign an NDA before discovery if you need one.
Support after launch
We stay on for fixes, upgrades and new features, or hand over cleanly to your in-house team with the documentation to match.
FAQs
Questions we get asked.
Straight answers on scope, cost, timelines and how we work. If yours is not here, ask us directly.
Do you carry out penetration tests?
We carry out security reviews and automated scanning as part of our engineering work, but for a formal penetration test we recommend an independent, CREST-accredited firm. An independent result carries weight with customers and insurers; we then fix what the testers find.
Can you help us with Cyber Essentials?
Yes, with the technical side. Cyber Essentials certification is awarded by a licensed certification body, not by us. We help you meet and document the controls that touch your software and cloud accounts — secure configuration, patching, access control and MFA — so your submission has evidence behind it.
What is the OWASP Top 10, and does it apply to us?
It is a widely used list of the most serious web application security risks, such as broken access control and injection. If you run a web app or an API, it applies. It is a sensible baseline for reviews and often the first thing customers and testers check against.
How much does a security review cost?
It depends on the size of the application and what you need. Clearing a defined set of pen-test findings can be quoted as fixed-price work; a broader review usually starts with a discovery sprint, from £2,000, to agree scope. Ongoing security maintenance can sit inside a support retainer.
Can you fix findings from a pen test another company carried out?
Yes. Send us the report and access to the code; we triage each finding, estimate the fixes, make them with tests and prepare notes for the tester’s retest. Some findings are better accepted with a documented reason than fixed, and we will say so.
Will security work slow down our roadmap?
Less than a breach would. Once set up, most controls — scanning in CI, secret management, secure defaults — run automatically. We agree with you how to balance fixes against features, starting with the highest-risk issues.
How do you handle our code and credentials during a review?
Under NDA if you want one, through named accounts with MFA and only the access we need. We rarely need production customer data to review code; where testing needs data, we use staging with anonymised or synthetic records.
Can you help us answer customer security questionnaires?
Yes, the technical sections: architecture, encryption, access control, logging, backups, vulnerability management and secure development. We answer from what is actually in place, and where the honest answer is "not yet", we can close the gap before you reply.
How does secure development relate to UK GDPR?
UK GDPR requires appropriate technical and organisational measures to protect personal data. Secure code, access control, encryption and logging make up much of the technical side. We can document what is in place for your DPIA or records; legal interpretation stays with your DPO or adviser.
Which security standards do you work to?
We use the OWASP Top 10 and OWASP ASVS as checklists, NCSC guidance for cloud and authentication, and the UK government’s voluntary Software Security Code of Practice as a frame for vendors. We work to these standards; we do not claim any certification against them.
Start a project
Have a pen-test report, questionnaire or deadline?
Send us what you have — a report, a customer questionnaire or simply a worry about an old codebase. We will tell you what it would take to close the gaps.
What happens next
- 1A senior engineer reads your brief within one working day, and replies with questions or a first view.
- 2A 30-minute call to understand the goal, constraints and what good looks like — no sales script.
- 3A written proposal with scope, milestones, team and a GBP estimate you can take to your board.
Techsleight Labs is a trading name of Krapton IT Consultancy.
Explore