Can one of your customers see another customer’s details?
Often they can — by changing one number in a link. We find out whether yours can, show you exactly where it happens, and prove the fix worked without breaking your own customers’ access.
A written report either way — including when the answer is “you’re fine.”
One question, answered properly
What we check
A cross-account access check. It answers one question about one part of your site — and it answers it with evidence rather than opinion.
Can customer A reach customer B’s data?
Orders, quotes, invoices, saved addresses, account details. If an identifier in a link or request is all that stands between two customers, we test whether yours holds.
Is it a login problem or a permission problem?
Many sites check that you’re logged in, then forget to check that the record belongs to you. Those are different failures and they need different fixes — so we separate them.
Does the fix actually fix it?
After a change, we test the hole is closed and that your own customers still get into their own accounts. A fix that locks out the owner isn’t a fix.
Early-client pricing — it rises once we have delivered references. And you can stop after any part; nothing is bundled to hide the price of the next step.
Three parts, priced separately
How it works
You can stop after any part. Nothing is bundled to hide the price of the next step.
The check — $500, fixed
We agree the scope in writing, test it with two accounts we control, and give you a written report with the evidence. If we can’t test it properly, you don’t pay.
The fix — quoted after the check
If there’s a flaw we identify the exact change in your code, and either write it with your access or hand it to your developer. Priced once we’ve seen the stack, because guessing is how people get overcharged.
The retest — $250, flat
We re-run the same test and prove two things: the hole is closed, and your own customers can still reach their own data. Most people fix and hope. The retest is the proof.
Said plainly, because it matters
What we promise — and what we don’t
We promise
- A written report with evidence, whether or not we find anything.
- Plain language. No jargon, no scare tactics, no “critical severity” theatre.
- The exact code change, if something is open.
- A retest that proves the fix didn’t break your own customers’ access.
- Written permission and agreed limits before we touch anything.
- If we can’t test it properly, you don’t pay.
We don’t promise
- That your site is secure. Nothing is — and anyone who says so is selling comfort.
- That we tested everything. We test what we agreed to test, and we name what we didn’t.
- That you’ll never be breached.
- A scanner printout dressed up as an assessment.
- Speed over substance — a rushed test is how false alarms get delivered as findings.
Who you’re dealing with
About Bowden Security
Bowden is a family name. It’s also the whole idea: a firm that sounds like it has been quietly doing the work for years, because that’s what small businesses actually want — someone who answers the phone and shows their reasoning.
Bowden Security is run by Liam O’Connor, in Edmonton, Alberta. Background in IT support and network administration, which is where the useful paranoia comes from: watching how easily a convenience feature becomes an open door.
We’re starting small and saying so. One check, done properly, with the limits written down — rather than a broad menu of promises we haven’t proven yet. AI tool testing and load testing are in development and will be offered when they’ve earned it, not before.
The work is done with modern tooling, including AI-assisted analysis. No tool output becomes a finding until a person has confirmed it against the evidence — and every report says which was which.
Start here
Tell us what your site does, and we’ll tell you if this check fits.
Email is best. You’ll get a reply from one person — not a ticket number.
Edmonton, Alberta, Canada · Serving small businesses locally and remotely.
General enquiries: info@bowdensecurity.com