Cloud security assessment
Most breaches are a setting, not an exploit
Nobody needed a zero-day to read an open storage bucket. We go through your cloud configuration read-only, find what is exposed or over-permitted, and tell you which five changes actually matter.
What we review
Eight areas, read-only throughout
Identity and access
Over-privileged roles, long-lived keys, missing MFA, and service accounts that can do considerably more than their job needs.
Storage exposure
Buckets and blobs readable by the public or by any authenticated user of the platform, which is not the same thing as yours.
Network boundaries
Databases reachable from the internet, security groups opened during a debugging session two years ago and never closed.
Secrets management
Credentials in environment variables, build logs, container images and CI configuration.
Database rules
Supabase row level security and Firebase security rules, which are where the real protection lives and where defaults are most often left untouched.
Logging and retention
Whether you would be able to reconstruct what happened after an incident, which most teams discover the answer to during one.
Backups and recovery
Whether backups exist, whether they are encrypted, and whether anybody has ever restored one.
Cost-linked exposure
Unauthenticated endpoints that cost you money per call. The invoice usually arrives before the breach is noticed.
If you built with Supabase or Firebase
Your rules are the whole security model
The public key in your frontend is meant to be public. What stops a stranger reading your tables is row level security, or Firebase security rules, and in applications assembled quickly those are very often still at their permissive defaults. When that is true, your application's own checks are irrelevant, because the database can be queried directly and your app is never involved. It is the first thing we look at, and it is the finding we report most often.
From
$2,500per account or project
Fixed before we start. Multi-account estates quoted after a short call. Fixing is separate and goes through your change process.
Book a scoping callFAQ
Common questions
Which platforms?
AWS, Google Cloud, Azure at a basic level, Cloudflare, Vercel, Supabase, Firebase and Render. If you are somewhere else, ask, and we will tell you if we are a good fit rather than learning on your budget.
Do you need admin access?
Read-only is enough and read-only is what we ask for. A security auditor with write access to your production cloud is itself a risk you have just created.
Will you break anything?
No. The review phase changes nothing at all. If you ask us to fix what we find, that is quoted separately and done through your normal change process with your approval on each change.
What does it cost?
From 2,500 USD for a single cloud account or project, fixed before we start. Larger estates with multiple accounts are quoted after a short call.
Let's talk
Tell us what you're building.
Get a free 30-minute strategy call. You'll leave with a clear plan, a realistic estimate and our honest opinion — whether or not you work with us.
- Email usmail@voliom.com