Websites and applications
Public attack surface, application behaviour, authentication, authorization and common implementation weaknesses.
Security assessment
Understand where your service is exposed.
RightsRelay provides independent, scoped security assessments for websites, servers, APIs and other internet-facing services. Each engagement is defined around systems you are authorised to submit, the risks you want examined and the depth of testing required.
Request an assessmentRequired before testing
Authorization is not a formality.
A submitted request is only an initial enquiry. If you cannot obtain written authorization from the system owner, do not submit a request to test that system.
- 01Written authorization from the owner of every system in scope
- 02An exact list of permitted domains, IP addresses and services
- 03A Statement of Work and Rules of Engagement
- 04Agreed permitted and prohibited testing methods
- 05A testing window, rate limits and an emergency contact
- 06Confidentiality and findings-retention terms
- 07Liability, cancellation, payment and refund terms
- 08Applicable law and the client’s legal and billing details
- 09Separate permission for third-party or cloud infrastructure where required
Possible scope
A focused assessment, shaped around the service.
The final methodology depends on the system, its operating environment and the question the work needs to answer.
APIs and integrations
Access controls, exposed operations, trust boundaries and the way connected services exchange data.
Servers and exposed services
Externally reachable services, transport security, configuration and unnecessary public exposure.
A defined security question
A focused review before launch, after remediation or when a specific risk needs independent validation.
Engagement process
Nothing active happens at the point of submission.
Request
Describe the service, your authority and the outcome you need.
Scope
Define exact targets, exclusions, methods, safeguards and contacts.
Proposal
Agree deliverables, schedule, fee and commercial terms in writing.
Assessment
Conduct only the authorised work within the agreed Rules of Engagement.
Findings
Receive prioritised findings, evidence, recommendations and an optional retest.
Pricing
Paid work begins only after a proposal is accepted.
Security assessments are paid engagements. Fees are agreed individually and depend on the number and type of systems, testing depth, authentication requirements, production constraints, reporting needs, timeline and retesting.
Submitting a request is free and creates no obligation to proceed. If the request is suitable, the scope, deliverables, schedule, payment terms and any deposit are set out before work begins.
Request an assessment
Describe the service and the decision you need to make.
This form creates an initial request for private review. It does not visit, scan or test the target you submit. Do not provide passwords, API keys, private keys or production data.