How we build
We hold our own products to the standard we recommend to clients. AI helps write the code; a disciplined process decides what ships.
As part of our pipeline we use enterprise DAST tooling and frontier cybersecurity AI.
Every change follows the same path
Step 1
Plan
Each change starts with a written plan and clear acceptance criteria.
Step 2
Build within guardrails
AI writes code inside defined limits: written instructions, restricted permissions, and no access to production systems or secrets.
Step 3
Test first
Automated tests are written alongside the code, not afterwards.
Step 4
Scan
Automated security and quality checks run on the code and on the running application.
Step 5
Independent review
A separate review, including a deliberate attempt to break it.
Step 6
Fix and re-check
Anything found is fixed, then every check runs again, not just the one that failed.
Step 7
Prove it in test
A production-like environment for load testing, restoring from backup and confirming everything still works.
Step 8
Human sign-off
A person decides what reaches production. Nothing ships automatically.
If anything is found at step 6, the change goes back to step 4 and every check runs again.
Hover over, tap or tab to a step for more detail.
The checks every change must pass
Static application security testing
Reads the source code for weaknesses before it ever runs: injection flaws, unsafe handling of user input, path traversal, insecure deserialisation, weak cryptography.
Dynamic application security testing
Tests a running copy of the application the way an attacker would: injection, authentication and session weaknesses, access-control gaps, misconfiguration and missing security headers. Always against an isolated test copy, never production.
Dependency and component scanning
Checks every third-party library and container image for known published vulnerabilities, and flags components that are out of date or no longer maintained.
Secret detection
Searches the code and its full history for passwords, keys and tokens that should never be there.
Code quality
Linting and automated checks for complexity, duplication and consistency, so the code stays readable and maintainable. Code that's hard to understand is hard to secure.
Automated tests
The full test suite runs on every change. A failing test stops the change.
Security review
A dedicated review of authentication, access control, data handling and the other areas automated checks can't fully judge.
Adversarial review
A separate pass whose only job is to find what's wrong: challenging the code, the tests and the assumptions behind them.
Two gates before anything reaches production
Development → Test
Every check above must pass. Anything found is fixed and the whole set runs again.
Test → Production
Load testing, a restore from backup that's actually proven to work, and confirmation that every feature still behaves as before. Then a person signs it off.
Guardrails for the AI itself
- AI works to written instructions and with restricted permissions.
- It never has access to production systems, production data or production secrets.
- Its sessions are protected by multi-factor authentication and lock when left idle — using AI Bouncer, our own product.
- Everything it produces goes through the same checks and gates as code written by a person.
How we rate what we find
Findings are rated Critical, High, Medium or Low, with Observations for matters that aren't vulnerabilities but still matter. We classify them against recognised industry references such as the OWASP Top 10, so you can see where each one sits.
Three separate environments — development, test and production — keep work in progress well away from your data.
The same checks, applied to your code.
Book a code review