API keys in your code: why it matters and how to fix it
Keys left in code are a common way businesses get breached. How to find them, what to do first, and how to stop it happening again.
fix-it
Fix-up projects
Turn a server nobody understands into one that is documented, supported and secure.
The problem
Some servers need more than a check. An old system that no longer gets security updates. A server nobody fully understands. A setup that has been patched together over years by different people.
None of that is unusual, and all of it can be sorted out without drama.
What's included
- Taking over an inherited server: documenting what is on it, getting access sorted, and removing old accounts and keys.
- Migrations: moving off systems that no longer get security updates, such as CentOS 7, onto a supported one such as Ubuntu LTS (long-term support) or AlmaLinux.
- Security hardening: updates, a properly set firewall, SSH keys instead of passwords, secrets moved out of code, backups that are tested, and monitoring.
- Clearing out what is no longer needed, so there is less to pay for and less to go wrong.
What you get at the end
A server that is supported, patched and secure, and that you understand.
A plain-English handover document: what runs where, how it is backed up, and how to get back in. Passwords and keys end up in one place that you control.
How it's priced
Every fix-up is quoted after the health check, so you know exactly what will be done and what it will cost before any work starts.
Who it's for
- Businesses still running CentOS 7 or another system past its end of support.
- Anyone who has inherited a server from a developer or agency who has moved on.
- Agencies taking over a client's hosting.
- Businesses that have had a health check and want the fixes done.
Questions
Why do I need a health check first?
So the quote is based on facts rather than guesses. You know exactly what will be done and what it will cost before any work starts.
Will there be downtime?
Usually little or none. Where some is unavoidable, we agree a quiet time in advance. Out-of-hours work is by arrangement.
How do I pay?
Half when you give the go-ahead, half when the work is finished.
What if you find something unexpected halfway through?
I stop and tell you before doing anything outside the agreed quote. You decide whether to go ahead.
Anything else I should know about prices?
- Retainer clients get 10% off project work and the breach rate.
- Out-of-hours emergency work is by arrangement, not a 24/7 promise.
- I'm not VAT registered, so there is no VAT to add.
Related guides
CentOS 7 is out of support: what now?
CentOS 7 stopped getting security updates in June 2024. What that means for your business, and your options, in plain English.
My developer left and nobody can access the server
Your developer has gone and nobody has the logins. How to get back control of your server, hosting account and domain, in the right order.
fix-it
Start with a health check
Every fix-up starts with a fixed-price health check, so you know what needs doing and what it will cost.