We look at what a website is actually publishing — keys in its JavaScript, files nobody meant to upload, settings that keep it out of Google — and write down what we found, when we found it, and what that does not prove.
Every record is timestamped by an independent authority, so it can be checked against them rather than against us — and every finding states what it does not prove, because a report that overstates once is a report you have to re-check entirely.
Preflight
For the person who built it. Two checks: what your live site is publishing, and — when you upload it — what is in your code and its history. Committed keys, and dependencies with known holes. None of it visible from a browser.
Handover
For the person who built it for someone else. A dated record of the state a site was in on the day you handed it over — which your client can check themselves, without an account and without taking your word for it. Accept it as the baseline, and a later scan says what has changed since.
Written up in full
Every project we could assess carried a known-vulnerable dependency.
How to check, and why a CDN can hide it from you.
Which questions have proof behind them, and which need an audit.
Including the version that leaks without the file being exposed.
Both modules observe a site from the outside on one date, plus — with the owner's proof — a short list of specific files. Neither is a penetration test, neither reads your source or logs in as anyone, and a clean record is not a guarantee that a site is secure. Every report states exactly what was and was not checked.