Security: WebApps

Security from the ground up

An app with real business data has to be secure. We don't bolt security on afterwards but build it in from the start, on a foundation (Laravel) where protection mechanisms are standard, not cobbled together by hand.

The building blocks

• Secure login & encrypted transmission: logins via proven mechanisms, everything over HTTPS.
• Fine-grained permissions: everyone sees and can do only what they're allowed; no back doors via the URL.
• Checked input: secured against the typical attacks (SQL injection, XSS, CSRF).
• Small attack surface: custom, lean code instead of a plugin collection with dozens of gateways.

In ongoing operation

Security-relevant core components are kept up to date as part of maintenance, suspicious operations are traceable via the audit log, and backups protect against an emergency. Security is not a one-time tick but part of operation.

Less risk than standard software

A large share of web security incidents trace back to outdated plugins and mass software. An individual app without that baggage is by nature harder to attack, and you know exactly what's in it.