nagarajanseshadri.com / Consulting / Security Audit
Platform-agnostic · Browser-based · PCI-DSS 4.0 mapped

Your ecommerce store has
gaps you don't know about.

Live security audits using real browser inspection — not black-box scanners. Platform-specific findings. Working remediation code. Fixed price, fast turnaround.

Request a free 15-min scoping call → See pricing ↓
20+
Years ecommerce
48h
Tier 1 turnaround
§6.4.3
PCI-DSS 4.0 mapped
0
Server access needed

Works against any platform — no server access, no exceptions

commercetools ct Frontend Salesforce Commerce Cloud SAP Commerce Cloud Oracle ATG OFBiz Adobe Commerce Shopify Plus Kibo WooCommerce Custom stacks Next.js · Nuxt · Remix
⚠️
PCI-DSS 4.0 §6.4.3 deadline passed March 2025 — most ecommerce sites are non-compliant
Every script on your payment pages must now be authorised, integrity-checked, and inventoried. Most sites load 10–40 third-party scripts on checkout with zero Content Security Policy. That's the compliance failure and the Magecart attack vector — same thing. A Tier 1 scan tells you where you stand in 48 hours.
Market context

How this compares to what else is out there

Automated tools are cheap but platform-blind. Enterprise platforms are smart but cost $12–25K/year. There's nothing in between with expert human interpretation.

SiteLock
$20–45/mo
Malware file scanning, no platform context, high false positive rate
Sucuri
$200–500/yr
WAF + cleanup service, not a security audit, misses config issues
Detectify
$70–90/mo per app
Good DAST automation, no ecommerce platform expertise, $12K+/yr entry
WhiteHat / Synopsys
Enterprise — quote only
Full DAST/SAST suite, $20K+/yr, requires internal security team to operationalise
This service
£499–£3,999
Platform-specific expertise, working remediation code, fixed price, no subscription
Service tiers

Fixed price. Fixed scope. Delivered.

Two PDFs every time: findings report and remediation guide with working code. No vague bullet points. No generic recommendations.

Tier 01
Passive Scan
"What can the open internet see?"
£499 fixed
↳ 48-hour turnaround
  • Production site — no staging access needed
  • Homepage, login, cart — 3 pages
  • Live HTTP headers, CSP, HSTS, cookies
  • Third-party script inventory + risk rating
  • BFF / API surface exposure (headless stacks)
  • PCI-DSS 4.0 §6.4.3 compliance status
  • DNS: SPF, DMARC, subdomain exposure
  • Findings PDF + Remediation PDF
Book Tier 1 →
Most popular
Tier 02
Full Audit
"Pre-launch sign-off. QSA prep."
£1,799 fixed
↳ 5 business days
  • Everything in Tier 1, plus:
  • Staging access — full checkout flow
  • Registration, login, my account, order history
  • Email enumeration, IDOR checks
  • Discount code enumeration + price manipulation
  • CSRF, brute-force lockout, form method audit
  • Session recording field masking verification
  • Platform-specific checks (CT, SFCC, SAP, ATG…)
  • Expanded findings + remediation PDFs
Book Tier 2 →
Tier 03
Remediation Sprint
"We don't just find it. We fix it."
£3,499 fixed
↳ 10 business days
  • Full Tier 2 audit included
  • Implementation of top 3 findings:
  • CSP — netlify.toml / Nginx + Next.js nonces
  • BFF CORS restriction + rate limiting code
  • Login/checkout form hardening (POST + CSRF)
  • Pull request or config files delivered
  • Findings + Remediation PDFs + code
Book Tier 3 →
Add-on
Quarterly re-scan retainer — £299/month
Re-run the Tier 1 scan every quarter. Delta report showing what changed. Always have a current snapshot for your QSA.
Enquire →
Why not just use an automated tool?

The scan is 10% of the work.
Interpretation is the other 90%.

Any tool can list HTTP headers. What it cannot do is tell you what they mean on your specific stack — or catch the things that don't look like vulnerabilities until you know what you're looking at.

🔍
Platform fingerprinting requires hands-on depth
Automated tools misidentify platforms constantly — calling a commercetools site "SFCC" based on stale database records. The entire remediation changes based on that call. BFF subdomain naming conventions, frontastic-session headers, CTX_ cookie patterns — these only mean something with direct platform experience.
⚡
Error responses mean different things per platform
A 542 from a ct Frontend BFF means a broken extension action — a deployment issue as much as a security issue. A generic scanner just sees a 5xx and flags "server error." That's a different finding, different team to notify, different fix.
🎯
Zero false positives
When a BFF subdomain contains a client group name, a scanner raises a "data bleed" finding. When staging returns EUR while the UI shows GBP, it flags a "pricing exploit." Neither is true. Expert interpretation means your team fixes real issues, not scanner noise.
🛠
Remediation code is stack-specific
"Add a CSP header" is useless advice. A CSP that actually works for your combination of Weglot + CookieYes + Webtrends + GTM on Netlify with Next.js App Router — that's what the remediation guide contains. Working netlify.toml and TypeScript middleware, not bullet points.
📋
PCI-DSS mapping requires compliance context
Connecting a missing CSP to §6.4.3, knowing the March 2025 deadline has passed, understanding what your QSA will actually scrutinise — this is 20 years of ecommerce architecture experience, not something a scan produces.
🔐
Session recording risks are invisible to scanners
autocomplete="new-password" on an address field looks like a security control to a scanner. It isn't — it's a UX anti-pattern. LogRocket patching the browser fetch API and potentially capturing card data is a finding no automated tool would raise.
Coverage

What every audit covers.

HTTP headers (passive)
  • Content-Security-Policy
  • X-Frame-Options / frame-ancestors
  • HSTS + includeSubDomains + preload
  • Referrer-Policy
  • Permissions-Policy
  • Cross-Origin-Opener-Policy
  • nosniff + server version leakage
  • security.txt
Third-party scripts
  • Full script inventory (first + third party)
  • GTM container IDs + access model
  • Subresource Integrity coverage
  • Session recording on checkout
  • Risk classification per script
  • Server-side GTM vs browser GTM
  • Mixed content
DNS security
  • SPF record presence + policy
  • DMARC policy strength
  • DKIM configuration
  • Subdomain enumeration
  • Subdomain takeover risk
  • robots.txt (staging environments)
API / BFF surface
  • Unauthenticated endpoint enumeration
  • Session token delivery (header vs cookie)
  • Internal IDs + store keys exposed
  • Stack traces in error responses
  • Rate limiting on auth endpoints
  • CORS origin policy
  • Shipping + pricing data exposure
Auth + checkout (Tier 2+)
  • Login form method (GET vs POST)
  • CSRF tokens on all forms
  • Email enumeration on registration
  • Brute-force lockout
  • Price manipulation (server-side validation)
  • Discount code enumeration
  • Order history IDOR
  • Currency / locale consistency
Platform-specific (Tier 2+)
  • CT: frontastic-session flags + BFF CORS
  • SFCC: OCAPI / SCAPI exposure
  • SAP: OCC API auth + Solr admin
  • ATG: /dyn/ path exposure, BCC surface
  • Shopify: App proxy + storefront API scope
  • Magento: Admin path + REST GraphQL auth
  • Custom: dependency CVE fingerprinting
Common questions

Before you book.

We have a WAF — aren't we protected?
WAFs protect against network-layer attacks. They don't protect against a compromised GTM tag running arbitrary JavaScript on your checkout page. That's inside the WAF — and it's the primary real-world ecommerce attack vector right now.
We just replatformed — we should be secure.
Replatforms introduce new attack surface: a new BFF API layer, marketing tags carried over from the old site, a checkout flow built under deadline pressure. Post-replatform is exactly when to audit — before those gaps become incidents.
Our payment provider handles PCI compliance.
Your payment provider is responsible for their vault. You're responsible for every script running on the page that could intercept card data before it reaches that vault. That's §6.4.3 — and it's on you.
Can't we just run an automated scanner?
You can. You'll get a list of header names and a CVE report. You won't know which findings are real on your platform, which are false alarms, what the remediation code looks like for your specific stack, or how any of it maps to your PCI obligations. That's what you're paying for here.
What if you find nothing critical?
That's a good outcome — you get a clean report to show your QSA or board. In practice, every site audited has had at least one CSP gap and one third-party script concern. The question is severity and whether you'd rather find it now or after an incident.
Get started

The passive scan takes 48 hours.
The breach investigation takes months.

Start with a free 15-minute scoping call. No commitment required.

Book a free scoping call →

Email: hello@nagarajanseshadri.com · LinkedIn: nagarajanseshadri

↩ Back to nagarajanseshadri.com · Consulting overview · Contact