API keys in your code: why it matters and how to fix it
Keys left in code are a common way businesses get breached. How to find them, what to do first, and how to stop it happening again.
check-it
Server health check
Find out what state your server is really in, in plain English, for a fixed price.
£295
Book a health checkThe problem
Your business depends on a server and you are not sure what state it is in. Maybe whoever set it up has moved on. Maybe it hasn't been updated for a while. Maybe it's fine.
A health check tells you which. It is the best first step before spending money on anything else.
What's included
- Access: who can log in, which SSH keys (the digital keys used to log in) are still active, and which old accounts should go.
- Updates: whether the operating system and software are still supported and patched.
- Security basics: the firewall, open ports (the doors a server leaves open to the internet) and protection against password guessing.
- Backups: whether they exist, where they go, and whether anyone has tested getting data back.
- Secrets in code: passwords or API keys (the keys software uses to talk to other services) left in files where they shouldn't be.
- Size and cost: whether the server is the right size for what it does.
- Monitoring: whether anyone would know if it stopped working.
What you get at the end
A written report within three working days of me getting access. It says what I found, what matters and what to fix first. Each fix is marked by how urgent it is and roughly how much work it takes.
Then a 30-minute call to go through it and answer your questions. The report is yours to keep, whoever does the fixes.
Price
- One server
- £295
- Each extra server
- +£95
Who it's for
- Businesses that inherited a server from a developer or agency who has moved on.
- Agencies taking on a client's server and wanting to know what they are walking into.
- Anyone about to rely on a server more than they do today.
- Anyone whose server has never had an independent check.
Questions
What access do you need?
A user account with admin rights (sudo) that I log in to with my own SSH key. I don't need your passwords, and you can remove my access as soon as we are done.
Will you change anything on my server?
No. A health check is look only. If I find something urgent, I tell you straight away and only fix it with your go-ahead.
How long does it take?
You get the report within three working days of me getting access, and we book the call for a time that suits you.
I have more than one server. How does that work?
Each extra server is +£95 on top of the first. They all go in one report, so you can see the whole picture.
Do I have to use you for the fixes?
No. The report is written so any competent sysadmin can follow it. If you would like me to do the work, I will quote for it as a fix-up project, so you know the cost before anything starts.
When do I pay?
I invoice when I deliver the report, with 14 days to pay.
Anything else I should know about prices?
- Retainer clients get 10% off project work and the breach rate.
- Out-of-hours emergency work is by arrangement, not a 24/7 promise.
- I'm not VAT registered, so there is no VAT to add.
Related guides
CentOS 7 is out of support: what now?
CentOS 7 stopped getting security updates in June 2024. What that means for your business, and your options, in plain English.
My developer left and nobody can access the server
Your developer has gone and nobody has the logins. How to get back control of your server, hosting account and domain, in the right order.
check-it
Book a server health check
Tell me a little about your server and I will come back to you with a start date.