Breaking through a firewall is hard work, so attackers prefer an application that has been left wide open from the inside. Consider a Celje web shop selling prams and children's gear. Every Pantheon user holds administrator rights, because one person once struggled to open a report and was granted everything, permanently. The product feed to Ceneje.si and Amazon runs under a single employee's own credentials, meaning his account cannot be disabled on departure without halting orders. The payment gateway's secret key is hard-coded in the shop, and an old agency still keeps a copy of that code. Each issue looks harmless in isolation; combined, they hand an intruder a shortcut. Application security closes these openings in the software that runs your operations. For bought-in packages we concentrate on roles, accounts and integrations. For software built for you, code and third-party libraries come into scope as well. We work online, in step with your software supplier, and the application stays available throughout.
Packaged and bespoke software are both covered. Packages are mostly about roles and integrations; custom software also brings the codebase and your release process into view.
Whether you use Pantheon, Minimax, Metakocka, Business Central or SAP Business One, we review who can create partners, adjust price lists or touch bank account fields. You receive a compact role design that keeps conflicting duties apart.
Connections to marketplaces, your e-invoice exchange, couriers and the bank are moved onto their own technical identities with only the rights required. Staff departures no longer break anything.
API keys, database credentials and certificates move from code, settings files and inbox history into a proper secrets store such as Azure Key Vault, AWS Secrets Manager or a shared password manager, and anything possibly exposed is reissued.
Single sign-on through Entra ID or Google wherever supported; otherwise individual accounts protected by a second factor. Removing a leaver happens in one console.
Custom builds get automated library audits, leaked-secret checks and basic code analysis in the CI pipeline, so a vulnerable package is flagged long before release.
Edits to payee details, prices and permissions are logged against a name and a timestamp. That history exposes fraud attempts and strengthens your hand in any dispute.
Problems cluster where systems connect, so the first job is a map of applications and their links.
One page showing your applications, their users, the identity behind every integration and the storage location of each key.
Roles, identities, secrets and logging are reviewed app by app. Issues are ordered by severity, each paired with a remedy.
Dedicated service identities, the vault and the new role design are introduced gradually and coordinated with your supplier so connections never drop.
A brief checklist for anything new you connect, automated build-time checks and a yearly look at who can do what.
Accounts without an owner are the riskiest kind. A feed running in an ex-employee's name, an admin login forgotten after switching agencies, a payment key in source code: they trigger nothing until someone stumbles across them. Each identity and secret should have a named owner, a stated purpose and a renewal date.
The role design is agreed with you first. With suitable rights we apply it remotely ourselves; otherwise we do it alongside your software partner. We never edit a package's database by hand, only through its own administration screens.
Replace it: issue a fresh key in the marketplace portal, switch the integration over and revoke the old one. The new key is stored in the vault with limited visibility. Keys for Stripe, Bankart or other payment services are handled identically.
That is a separate service in Software testing and QA. This service builds ongoing hygiene, namely roles, key management and dependency checks. Both work well together, and good hygiene makes fixing pen-test findings far quicker.
A firm with several applications and half a dozen integrations usually needs between one and two weeks. Where the scope is well defined we quote a fixed fee; otherwise time is charged at €50 per hour plus VAT within an estimate you approve.
Name the business software and connections you rely on, and we will propose a starting point.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.
