MingxiSecurity CheckPractical website and API security guidance for small businesses. Understand the scope, ask better questions and turn findings into improvements.
Two quotes for a website security test may buy different work. Compare the named target, login access, evidence, exclusions and retesting terms. Mingxi’s US$120 standard check covers an agreed unauthenticated public target; it is not a full application penetration test.
If a secret credential reached the browser, deleting the visible string does not invalidate copies. Have the owner revoke or rotate it, check its use and remove exposed copies. First confirm whether it is actually a secret: some providers deliberately issue public client keys.
An AI-built site needs security checks against the deployed version, not just a working preview. Start with public files, credentials and server-side input handling. Record which checks still need access to source code or approved test accounts.
No AI review comments means no issues were reported in that review. It does not establish that the deployed service is secure. Ask which code was available, what evidence supports each finding and which checks were never performed.
Prompt injection can arrive in a retrieved document as well as a chat message. For a chatbot with data or tools, examine what it can read and execute. A well-written system prompt does not replace access checks enforced outside the model.
Start with the public services you operate, the data they handle and the people responsible for them. A useful security check ends with assigned remediation work, not just a scanner score.
Black-box describes the tester's visibility into a system. Automated scanning describes a technique. They are not competing labels: a scoped assessment can use both automation and manual investigation.
Before testing, agree the assets, permitted actions, time window and emergency contact. A clear operating plan helps the business and tester recognize when to pause rather than improvise.
Authentication tells an application who the user is. Object-level authorization decides whether that user may access the specific record being requested. Both are needed in a customer-facing API.
Treat an uploaded attachment as untrusted data. File checks, private storage and controlled retrieval serve different purposes; accepting only a familiar extension is not a complete upload policy.
A login review should include account recovery and sensitive account changes, not only the sign-in screen. A strong primary login can still be undermined by a weaker recovery path.
HTTPS protects communication in transit. It does not decide whether a logged-in customer may read another customer's record or whether an uploaded document is stored privately.
Prioritize with both technical evidence and business context. A severity label is a starting point for discussion, not a substitute for knowing what is exposed and who can fix it.
Read the scope and limitations before the findings count. Then identify which issues need a business decision, which need engineering work and which still need clarification.
A fix should be verified in the environment where it matters. Retesting should confirm the original problem is addressed and that expected legitimate behavior still works.