Can one of your customers see another customer’s details? And is your site slow?
Often the answer to the first is yes — by changing one number in a link. We find out whether yours can, show you exactly where it happens, and prove the fix worked without breaking your own customers’ access. In the same visit we measure how the site behaves when several people use it at once, and name the cause if it’s slow.
A written report either way — including when the answer is “you’re fine.”
Two questions, answered with evidence
What we check
One visit, two checks. Can one customer reach another customer’s data — and how does the site behave when more than one person is on it at once. Both answered with evidence rather than opinion, and both in the same written report.
Can customer A reach customer B’s data?
Orders, quotes, invoices, saved addresses, account details. If an identifier in a link or request is all that stands between two customers, we test whether yours holds.
Is it a login problem or a permission problem?
Many sites check that you’re logged in, then forget to check that the record belongs to you. Those are different failures and they need different fixes — so we separate them.
Does the fix actually fix it?
After a change, we test the hole is closed and that your own customers still get into their own accounts. A fix that locks out the owner isn’t a fix.
How does the site behave when it gets busy?
We watch the site with one visitor, then with several at once — within an agreed ceiling, on a quiet window, with a written stop condition. We report what a customer actually feels: response times, failures, and how many bytes each visit costs them.
If it’s slow, why?
A graph is not an answer. We open the page as it’s delivered to a customer and name the cause — an oversized script, a page that can’t be cached, missing compression — and point at the exact setting or line to change.
Early-client pricing — it rises once we have delivered references. You can stop after any step; nothing is bundled to hide the price of the next one.
Three steps, priced in the open
How it works
You can stop after any step. Nothing is bundled to hide the price of the next one.
The check — $500, fixed
One visit, both checks — the cross-account test and the speed audit — written up as one report with the evidence. $500 covers one; $750 covers the pair, because it’s the same visit and the same report. That’s the whole service: $1,000 with a fix and retest. If we can’t test it properly, you don’t pay.
The fix and the retest — $250, flat
We identify the exact change — the line of code, or the server setting — then make it with your access or hand it to your developer. Then we re-run the same test and prove two things: the hole is closed and your own customers still get in, and the site is faster rather than broken. One price for both, because a fix nobody verified isn’t finished.
Nothing found? You still get the proof
If both checks come back clean, you get the written report saying so — the evidence that your site held. Most people fix and hope. The retest is the proof, and so is a clean result you can show someone.
Said plainly, because it matters
What we promise — and what we don’t
We promise
- A written report with evidence, whether or not we find anything.
- Plain language. No jargon, no scare tactics, no “critical severity” theatre.
- The exact code change, if something is open — and the exact setting, if something is slow.
- A retest that proves the fix didn’t break your own customers’ access, and didn’t make the site slower.
- A load window agreed in writing first, with a stop condition we’ll honour — error rate, response time, or your word.
- Written permission and agreed limits before we touch anything.
- If we can’t test it properly, you don’t pay.
We don’t promise
- That your site is secure. Nothing is — and anyone who says so is selling comfort.
- That we tested everything. We test what we agreed to test, and we name what we didn’t.
- That you’ll never be breached.
- That your site “handles 10,000 visitors.” We can say it handled twenty, on this page, on this date — and nothing more.
- That you’ll be a set percentage faster. We measure it after the change, and report the number we got.
- That a busy afternoon is the same as a sold-out launch. Finding the breaking point is a bigger job, separately scoped.
- A scanner printout dressed up as an assessment.
- Speed over substance — a rushed test is how false alarms get delivered as findings.
Who you’re dealing with
About Bowden Security
Bowden is a family name. It’s also the whole idea: a firm that sounds like it has been quietly doing the work for years, because that’s what small businesses actually want — someone who answers the phone and shows their reasoning.
Bowden Security is run by Liam O’Connor, in Edmonton, Alberta. Background in IT support and network administration, which is where the useful paranoia comes from: watching how easily a convenience feature becomes an open door.
We’re starting small and saying so. One visit, two checks, done properly, with the limits written down — rather than a broad menu of promises we haven’t proven yet. The speed side was proven on a real live client site: five thousand eight hundred requests, no failures, and a 367 KB script found sitting in the page that every visitor re-downloaded. AI tool testing is still in development and will be offered when it has earned it, not before.
The work is done with modern tooling, including AI-assisted analysis. No tool output becomes a finding until a person has confirmed it against the evidence — and every report says which was which.
Start here
Tell us what your site does, and we’ll tell you if this check fits.
Email is best. You’ll get a reply from one person — not a ticket number.
Edmonton, Alberta, Canada · Serving small businesses locally and remotely.
General enquiries: info@bowdensecurity.com