Can one of your customers see another customer’s details?
Often the answer is yes. One number in a link is all that stands between two customers, and nobody has checked yours. We test whether it holds, show you exactly where it breaks, and prove the fix worked without locking out your own customers. In the same visit we measure how the site behaves when several people use it at once.
For small businesses and AI-built apps that went live before anyone checked who can see what.
A written report either way, including when the answer is “you’re fine.”
Three checks, one visit
What we check
Can one customer reach another customer’s data. How the site behaves when more than one person is on it. And whether an AI assistant on the site can be talked into something it shouldn’t do. All three answered with evidence, in one written report.
Can customer A reach customer B’s data?
Orders, quotes, invoices, saved addresses, account details. If an identifier in a link or request is all that stands between two customers, we test whether yours holds.
Is it a login problem or a permission problem?
Many sites check that you’re logged in, then forget to check that the record belongs to you. Those are different failures with different fixes, so we separate them.
Does the fix actually fix it?
After a change we test two things: the hole is closed, and your own customers still get into their own accounts. A fix that locks out the owner isn’t a fix.
How does the site behave when it gets busy?
We watch the site with one visitor, then with several at once, inside a ceiling agreed in writing, in a quiet window, with a stop condition we honour. We report what a customer actually feels: response times, failures, and bytes per visit.
If it’s slow, why?
We open the page as it’s delivered to a customer and name the cause: an oversized script, a page that can’t be cached, missing compression. Then we point at the exact setting or line to change.
Can a stranger make your AI assistant act?
If a chat assistant or AI agent sits on your site, we check what untrusted text can make it do: read the wrong record, send an email, call a tool it shouldn’t. We also check whether a human approval step survives contact with a real customer. Method proven on a local model; your assistant is the first one we’ll run it against live.
Early-client pricing. It rises once we have delivered references, and you can stop after any step.
Priced in the open
What it costs
One visit covers all three checks. You pay for the ones you want, and you can stop after any of them.
The checks
$500 for one check. $750 for any two. $1,000 for all three, because it is the same visit and the same report. Cross-account access, speed under load, and the AI assistant check. If we can’t test it properly, you don’t pay.
The fix and the retest, $250
We identify the exact change (the line of code, or the server setting), then make it with your access or hand it to your developer. Then we re-run the same test and prove the hole is closed and your own customers still get in. All three checks plus the fix and retest comes to $1,250.
Nothing found? You still get the proof
If the checks come back clean, you get the written report saying so. Most people fix and hope. The retest is the proof, and so is a clean result you can show someone.
Said plainly, because it matters
What you get
Every time
- A written report with evidence, whether or not we find anything.
- Plain language. No jargon, no scare tactics, no “critical severity” theatre.
- The exact code change if something is open, and the exact setting if something is slow.
- A retest that proves the fix didn’t break your own customers’ access, and didn’t make the site slower.
- A load window agreed in writing first, with a stop condition we’ll honour: error rate, response time, or your word.
- Written permission and agreed limits before we touch anything.
- If we can’t test it properly, you don’t pay.
What we won’t claim
- That your site is secure. We can tell you what we tested and what we found.
- That we tested everything. We test what we agreed to, and we name what we didn’t.
- That your site “handles 10,000 visitors.” We can say it handled twenty, on this page, on this date.
- That you’ll be a set percentage faster. We measure after the change and report the number we got.
Who you’re dealing with
About Bowden Security
Bowden is a family name. Liam O’Connor runs Bowden Security from Edmonton, Alberta.
He came from IT support and network administration, which is where the useful paranoia comes from: watching how easily a convenience feature becomes an open door. A remote-access tool nobody removed. A sharing setting left open. A test account from 2019.
Most of what gets checked now is built fast, often with AI, and shipped before anyone asked who can see what. That is the gap this exists to close, for small businesses on a platform and for founders who built their own app.
We’re starting small and saying so. The speed work is proven on a real live site: two runs, 6,801 requests, no failures, and a 367 KB script found sitting inside the page that every visitor re-downloaded. No tool output becomes a finding until a person has confirmed it against the evidence, and every report says which was which.
Start here
Tell us what your site does, and we’ll tell you if this check fits.
Email is best. You’ll get a reply from one person, not a ticket number.
Edmonton, Alberta, Canada. Small businesses here and anywhere else.
General enquiries: info@bowdensecurity.com