Websites
For PHP-backed sites, confirm the serving runtime and your host’s patch evidence. A WordPress update alone does not establish that PHP is patched.
WordPress notice ↗Schema · Security / Audit + remediation
Know your
exposure. Fix
what matters.
Schema reviews your web stack, access and patch evidence. Built for agencies and small SaaS teams that need a clear, prioritized security plan.
Fig 01.A · Security reviewIllustrative report structure
Schema / Review workspaceScope before access
The deliverable
View the checklist ↗Evidence. Findings. Next steps.
Review areaEvidence to collectNext decision
Serving runtimeVersion and vendor patch recordConfirm applicability
Privileged accessMFA and administrator ownershipReview controls
Connected credentialsProvider notices and rotation recordCoordinate changes
RecoveryBackup and restore-test evidenceDocument readiness
01The current context
Headlines into
action.
PHP. Node.js. GitLab. Railway.
The useful question is what applies to your systems.
Applications
Review deployed Node.js runtimes and self-managed GitLab against their security releases. GitLab.com was already patched in GitLab’s notice.
Node.js release ↗GitLab release ↗Credentials
Railway’s disclosure recommends credential rotation and connected-service log review. Map dependencies so changes can be coordinated.
Railway disclosure ↗Source snapshot: 22 October 2026. Check the current vendor guidance before acting. A vulnerability notice does not establish that your business has been compromised.
02Free exposure self-check
Start with
what you know.
A free, two-minute self-check. Your answers stay in this page until you choose to include them in an email.
This questionnaire does not scan your systems or calculate your probability of a breach.
Download the plain-text checklist ↗Your next steps
No systems were tested. These suggestions depend on your answers and the dated source snapshot.
03How it works
A plan you
can act on.
A scoped review ends with evidence you can hand to your own team, your host or another provider.
- Agree the scope
- Name the assets, authorized methods and delivery date before access or payment.
- Review the evidence
- Check applicable advisories, patch state, access and scoped secret/dependency exposure. Mark the unknowns.
- Decide what to fix
- Receive prioritized findings, limitations and a written action plan. We walk through it together.
- Verify the changes
- If you choose remediation, agree the changes, rollback and acceptance tests first. Get a documented retest.
Diego delivers the review through Schema. Each engagement has a named scope and confirmed schedule.
04Scope & pricing
Your audit.
$995.
Up to five named web deployments, one repository and one tenant, within six delivery hours.
Includes evidence review, prioritized findings, a written fix plan and a 30-minute walkthrough. Target delivery: three business days from the agreed start and access, confirmed in your quote.
Need a larger scope? Expanded reviews start at $2,495. All prices in USD; tax and third-party costs, if any, are itemized in advance.
Then, fix what matters.
$1,500 focused remediation
Up to three agreed changes in one environment, within six hours including tests and handoff.
$3,500 standard remediation
Up to eight agreed changes in two environments, within fourteen hours including tests and handoff.
Final scope and schedule are agreed separately. Complex migrations and active incidents need a separate assessment. There is no obligation to buy remediation.
05Frequently asked questions
Clear boundaries.
Is this a penetration test?
No. This is a point-in-time, scoped evidence and exposure review. Exploit execution, phishing, comprehensive code review and compliance certification are excluded.
Will you change production during the audit?
Changes require a separate approved remediation scope, backup/rollback plan and agreed window. The audit itself does not authorize production changes.
What if something is already compromised?
This offer is not an emergency response service. Contact your established incident-response provider and follow their guidance. Tell us about active incidents before booking so we can determine whether a specialist is needed.
Can an agency include client websites?
Yes, within the agreed asset cap and with appropriate written client authorization. Possession of a login alone is not authorization to test.
Does a clean report mean we’re safe?
No review can guarantee that. The report distinguishes confirmed findings, inconclusive checks, exclusions and the evidence available at that time.
What happens if the work is larger?
We stop at the agreed scope/time cap, document what remains and quote a change order before any additional work. You choose whether to proceed.
06Start with a conversation
Let’s scope it.
Tell us the size of your estate. We’ll confirm fit, scope, availability and price before work starts.
Send no passwords, keys, customer records or sensitive logs.
Your inquiry is ready.
Nothing has been sent. Open your email app, review the draft and send when you’re ready.
Open email draft ↗No email app configured?
Copy the text below into an email to projects@schemacorp.com.