Security in the code.
Not a separate cyber service.
When we build or maintain a website or web app, security is part of the product’s technical requirements: code, access controls, dependencies, configuration and deployment. Perseo does not offer enterprise cybersecurity, offensive security or SOC services.
Discuss the projectSecurity integrated into web development
We work on security aspects that are directly part of the code, configuration and maintenance of the web product.
Secure coding
Input validation, error handling, server-side controls and development patterns aimed at reducing vulnerabilities introduced by application code.
HTTPS, TLS and security headers
HTTPS setup, correct redirects and headers such as CSP, HSTS, Referrer-Policy and Permissions-Policy when appropriate for the project.
Authentication and permissions
Correct implementation of login, sessions, roles and application authorization with a least-privilege approach.
Dependencies, CMS and updates
Framework, plugin and library updates, removal of unused components and technical dependency management.
Configuration and secrets
Environment separation, credentials and variable management, file permissions and server configuration aligned with the application.
Backups and technical recovery
Application backups and restore procedures for the website or web app as part of normal product maintenance.
How we work
Security is treated as a software-quality requirement, not as a standalone cybersecurity package.
Least privilege
Users, services and processes receive only the permissions they actually need.
Server-side validation
Inputs are checked where they can affect the application, infrastructure or stored data.
Dependency hygiene
Updates and third-party components are managed as part of the normal maintenance lifecycle.
Separated environments
Development, staging and production remain distinct, with appropriate configuration and credentials.
Code review and testing
Changes are verified as part of development through functional testing and reproducible technical checks.
Documented changes
Relevant configuration, dependencies and interventions are documented to keep the project maintainable.
A clear scope
This service covers security only as it applies directly to developing and maintaining websites and web applications.
Within scope
- Fixing code-level issues found during development, maintenance or ordinary technical checks.
- Application and configuration hardening directly related to the website, CMS or web app.
- Technical implementation of authentication, permissions, sessions, dependencies, HTTPS and security headers.
- Technical restoration of a compromised website or CMS when the work is limited to restoring and updating the web product, without forensic activity.
Not offered as a service
- Vulnerability assessments, penetration testing, red teaming or offensive security.
- SOC, 24/7 security monitoring, MDR or managed threat-detection services.
- Incident response, digital forensics, threat intelligence or attack investigations.
- Enterprise cyber advisory, network security or cloud security as standalone services.
- NIS2, DORA, ISO 27001 or other cybersecurity-framework assessments and compliance consulting.
- Security-awareness training, phishing simulations or organizational security programs.
Perseo Research
Passive web-security research
The IWSS project passively measures publicly observable configuration such as TLS, security headers, CSP, cookies, email authentication and security.txt. This research is separate from commercial offensive-security or vulnerability-assessment services.
Building or maintaining a web project?
We can integrate good security practices directly into the code, configuration and maintenance lifecycle of your website or application.
Discuss the project