root@kavalu:~$ ./services --list
Find security weaknesses. Understand the evidence. Get practical guidance to fix what matters.
root@kavalu:~$ ./website-security --checks
We examine key areas of your website to identify security weaknesses, explain the risks, and recommend practical improvements.
HOVER OVER A LINE OF THE RESPONSE TO SEE WHAT WE CHECK AND WHY IT MATTERS · ON TOUCH SCREENS, TAP A LINE
AREA 01 / 05
Check whether your website protects information sent between visitors and your site.
WHAT WE CHECK
WHY IT MATTERS
Helps identify connection settings that may expose visitors to avoidable risk.
AREA 02 / 05
Review website settings that help browsers protect visitors from common risks.
WHAT WE CHECK
WHY IT MATTERS
Correct settings can add useful layers of protection, depending on the application.
AREA 03 / 05
Check settings that help protect login sessions and keep session information safer.
WHAT WE CHECK
WHY IT MATTERS
Cookie settings help reduce certain ways session information can be exposed or misused.
AREA 04 / 05
Check whether visitors are sent to the expected destinations when pages redirect.
WHAT WE CHECK
WHY IT MATTERS
Unexpected redirects can confuse visitors or create security risks in some circumstances.
AREA 05 / 05
Look for technical details your website may reveal publicly without needing to.
WHAT WE CHECK
WHY IT MATTERS
Excessive detail can help outsiders learn more about the technology behind a site.
Actual checks depend on the agreed assessment scope and available testing capabilities.
root@kavalu:~$ ./checker --scope public-indicators
Check selected security settings visible from outside your website. Understand what was observed, why it matters, and what may need attention.
Enter a public website address you own or have permission to assess.
HTTPS behavior and certificate details.
Selected HTTP security headers.
Relevant cookie security attributes.
Observed redirects and destinations.
Technical details exposed in responses.
No assessment results yet. When the checker is available and a check completes, evidence and explanations will appear here.
A public security check covers only the checks performed. It does not replace a full security assessment or prove that a website is secure.
root@kavalu:~$ ./reports --example
See how security findings are documented, supported by evidence, and translated into practical fixes.
executive-summary
This example shows how security observations are documented, assessed, and prioritized. Each finding explains the evidence, potential impact, and recommended next steps.
scope · methodology · risk
Results depend on the systems tested, the checks performed, and the evidence collected. Severity should reflect the verified issue and its context.
A complete example, from summary to limitations.
LIMITATION: Findings reflect only the checks performed and evidence collected. No finding does not guarantee that a system is secure.
root@kavalu:~$ ./process --stages
HOVER OVER A STAGE TO SEE WHAT HAPPENS IN IT · ON TOUCH SCREENS, TAP A STAGE
01
We agree on the systems to assess, testing boundaries, and written permission before work begins.
DELIVERABLEAGREED SCOPE
WHAT HAPPENS
NEXT → 02 Test & collect evidence
02
We perform the agreed security checks and record relevant observations and supporting evidence.
DELIVERABLETEST OBSERVATIONS
WHAT HAPPENS
NEXT → 03 Review & validate findings
03
We review the evidence, check the basis for each finding, and distinguish confirmed issues from observations.
DELIVERABLEREVIEWED FINDINGS
WHAT HAPPENS
NEXT → 04 Report & recommend fixes
04
We explain the risks, provide practical remediation steps, and identify what should be addressed first.
DELIVERABLESECURITY ASSESSMENT REPORT
WHAT HAPPENS
FINAL STAGE
root@kavalu:~$ ./services --list
We help you find security weaknesses, understand the risks, and fix problems before they become bigger issues. Explore our services to see how we can help.
We check your website for security weaknesses that attackers could use to access information or misuse its features.
WHAT WE DO
OUTCOMEKnow what needs fixing on your website.
We safely test how your web application behaves under attempted attacks, with your authorization.
WHAT WE DO
OUTCOMEUnderstand how attackers might misuse your application.
We check the connections that allow your website, mobile app, and other systems to exchange data.
WHAT WE DO
OUTCOMEHelp protect the data flowing between your systems.
We identify potential security weaknesses across the agreed systems and help you decide which ones to address first.
WHAT WE DO
OUTCOMEKnow which security issues deserve attention first.
We review important security settings to identify mistakes or gaps that could leave your systems exposed.
WHAT WE DO
OUTCOMEImprove your systems’ security settings.
root@kavalu:~$ ./methodology --compare
Understand the difference between a basic external check and a structured security assessment.
A quick look at selected, publicly visible security settings on a website.
WHAT IT CAN DO
BEST FOR
An initial look at common external indicators.
A planned review of agreed systems, with testing, evidence, and actionable recommendations.
WHAT IT CAN INCLUDE
BEST FOR
Understanding and addressing security risks in greater depth.
Actual coverage depends on the selected service, agreed scope, and testing performed.
root@kavalu:~$ cat about.txt
Kavalu Labs helps organizations identify security weaknesses, understand their real-world implications, and take practical steps to address them. We focus on clear findings, useful recommendations, and transparent reporting.
We explain what was observed, how it was verified, and what the evidence does—and does not—prove.
We explain potential business impact in plain language and provide technical detail for the people fixing the issue.
We provide actionable recommendations that help teams prioritize weaknesses and improve their security posture.
We work within agreed scope and authorization, handle evidence carefully, and communicate limitations honestly.
root@kavalu:~$ ./contact --request-assessment
Tell us about your website, application, or system. We'll use the information to understand what you need and discuss an appropriate security assessment.
Share your contact details and a brief description of your requirements.
A straightforward process, from understanding your needs to agreeing on the right assessment.
We review the information you provide and clarify your security goals.
We identify the systems to assess, the required testing, and the boundaries of the work.
We discuss the proposed approach, deliverables, and authorization before testing begins.
Website security · Web application testing · API security · Vulnerability assessment
Submitting a request does not authorize security testing. Testing begins only after scope and authorization are agreed.