Skip to content
Get in touch
Augmensis Technologies Ltd

Code reviewed honestly. Software built securely.

Augmensis is a small UK consultancy. I review other people's code for security weaknesses and build software to the same standard. Security first, development second.

Start a conversation See what we do
Services

Two services, one skill set.

Writing software and reviewing it for security draw on the same knowledge, so each service is better for the other.

01

Secure code review

Manual, offline tool-assisted review of your source code for security weaknesses, done by a developer who still writes production code.

What you receive
  • One clear report: where you are exposed and what to fix first
  • A record of what was reviewed, which you can show customers or investors
  • Evidence tied to the code, not generic advice
  • Remediation guidance your developers can act on
  • A readout call to agree priorities
  • An optional re-review once fixes are in
  • No AI in the analysis: I review your code myself, and your code and data never leave the testing environment or reach third parties

Types of review: a pre-release or feature review, a full codebase review, a design and threat model review, or a dependency and secrets check.

02

Contract software development

Bespoke software and internal business tooling, designed with security in from the first line rather than added at the end.

Typical work
  • C# and .NET, including ASP.NET Core
  • TypeScript and JavaScript, front end and API
  • SQL back ends: PostgreSQL, SQL Server, MySQL
  • Docker, CI/CD pipelines and deployment
  • Extending, maintaining and supporting systems you already run

How it is engaged: remote, UK based. A day rate for ongoing work, or a fixed price against milestones for a scoped piece.

Approach

The review process

Six steps, from scope to readout.

  1. Agree the scope in writing

    What is in, what is out, what you will receive and when. Fixed deliverables and no surprises on the invoice.

  2. Understand the system

    How it is built, where the data flows, who can do what, and what matters most to you. A time-boxed review has to start with the riskiest parts.

  3. Work offline and in confidence

    Your code is held securely, never leaves the testing environment, and is deleted securely on completion of the contract.

  4. Check, then read by hand

    Automated checks run first, entirely offline. Then I read the code by hand, starting with the areas of greatest risk.

  5. Prove every finding

    Every finding is confirmed before it goes in the report, so you are not left chasing false positives.

  6. Report and read out

    A written report, then a call to walk through it and agree priorities. If you want it, I re-review once the fixes are in.

The development process

Security is part of every step, not a review at the end.

  1. Agree the scope in writing

    What will be built, what will not, how it will be delivered and when. Fixed deliverables and no surprises on the invoice.

  2. Understand the problem and the risks

    What the system must do, what it must protect, and who might want to misuse it. Security requirements are agreed alongside the functional ones.

  3. Design with security in

    How data, access and failure are handled is settled in the design, before the code. Decisions are written down so they can be reviewed.

  4. Build to a secure standard

    Secure coding standards, automated checks and testing are part of every change, not a phase at the end.

  5. Verify before delivery

    Before anything is handed over it is tested and reviewed against the security requirements agreed at the start.

  6. Hand over and support

    Documented and deployable, so your team can run it, with ongoing support if you want it.

About

Run by the person who does the work.

I am Derek Hampton (external site, opens in a new tab), director of Augmensis. I have written commercial software since 2012, across gambling, retail and financial services. For the last few years I have combined that with security: writing secure code review reports, building internal tooling security first, and taking part in coordinated vulnerability disclosure.

Augmensis is deliberately small. You deal with the person doing the work, and I limit the work to what I can do well.

Incorporated
2012
Based
United Kingdom, remote
Core stack
C#, .NET, ASP.NET Core, TypeScript, JavaScript, PostgreSQL, SQL Server, MySQL, Docker
Review focus
Web, API, internal tooling and services
Guided by
OWASP ASVS
Contact

Tell me what you are building, or what needs a second look.

A short description of the system and what you need is enough to start.

Please do not send source code or credentials by email. That is arranged once scope is agreed.

You are leaving augmensis.com

This link goes to an external website, . It will open in a new tab.

Continue to external site