Web application security / LARISKU
Authorized assessments with evidence, remediation, retesting and clear testing limits.
Back to the homepage05 / Security research & engineering
Web engineering informed by hands-on security research. We trace relevant controls, document evidence and explain what remains outside the review.
Define a security reviewAgree assets, test identities, demonstration data, traffic limits and written authorization before testing.
Review authentication, access control, input handling and configuration using OWASP categories relevant to the scoped features.
Findings describe root cause, evidence, impact and recommended fixes. Retesting checks the same controls after remediation.
Reports distinguish validated findings, hypotheses, testing limits and residual risk. No website is claimed to be 100% secure.
DEVELOPER CREDENTIAL / RED TEAM LEADERS
Awarded to Gusti Akmal Muttamidillah on 14 October 2026. This is the developer's credential, issued after passing the Red Team Leaders exam.
Verify with issuer ↗ View certificate (PDF) ↗
DEVELOPER CREDENTIAL / RED TEAM LEADERS
Awarded to Gusti Akmal Muttamidillah on 14 October 2026 after passing the Red Team Leaders exam. This is the developer's credential.
Verify with issuer ↗ View certificate (PDF) ↗
COURSE COMPLETION / COLUMBIA+
Online, non-credit course completed by Gusti Akmal Muttamidillah on 14 October 2026. Issued by Columbia Engineering Executive Education / Columbia+. Certificate ID: 197237492.
View course certificate (PDF) ↗
COURSE COMPLETION / CYBER ACADEMY
Completed by Gustiakmal Mutamidillah on 11 October 2022. Certificate ID: BWH1110221208.
View course certificate (PDF) ↗
CASE STUDY / 10 OCTOBER 2026
Authorized, time-bounded external assessment of the exact origin. The archive contains 78 first-party HTTP requests and independently reviewed evidence.
Read the full audit report (PDF) ↗AUDIT RESULT
The sample validated no impactful security finding or exploit chain. A search input formed a new HTML attribute, but the offline browser check did not execute the sentinel. Anonymous API requests were rejected, tested logins did not create an admin session, and search comparisons did not demonstrate SQL injection.
Backend source, comparative test accounts, and owner-side database, queue, and mail observations were unavailable. The result applies to the tested sample, not the whole site.
PERSONAL RESEARCH / REDACTED
The redacted version of the complete technical case study covers three historical candidates, evidence limits, and source appendices. Target, provider, account, and credential values appear as ***.
Read the evidence and limits ↗EVIDENCE STATUS
The archive directly shows a client-side configuration with a public anonymous role. Audit notes describe sensitive API reads, but raw admin and data API responses are absent. Access-control impact and present-day exposure cannot be independently confirmed from this folder alone.
PERSONAL RESEARCH / ARCHIVED EVIDENCE
An archived client bundle contains a public anonymous-role configuration. A separate probe note records sign-up and authentication error messages. Neither item proves unauthorized access to private data; public anonymous keys are expected in this architecture.
The audit notes list 492 API keys and 604 user profiles in admin results, plus 604 profiles, 11 payments, 528 messages, and 1,251 credit transactions in anonymous-role results. Individual keys, identities, and record values are shown as *** in the PDF. These numbers are from the notes, not independently verified raw responses.
CLAIMS REQUIRING RAW EVIDENCE
The audit notes report unauthenticated admin reads and anonymous data reads. The folder does not retain the corresponding raw HTTP exchanges, role controls, or a later retest. No write or account takeover impact is claimed: the recorded write probes used nonexistent IDs and changed no rows.
Not a full pentest. Excludes login testing, exploitation and security certification.
Written authorization is required. Assets, roles, endpoints and testing window are agreed before assessment; retesting is separate unless included.
Asset count, roles, testing time and deliverables are defined in the proposal. No guaranteed findings, certification or vulnerability-free claim.
Scope is agreed in the proposal.
06 / Workflow
Discuss website goals, audience, content and operational constraints before selecting features.
Record deliverables, fees, timeline, revisions, hosting and testing limits in a proposal.
Review the visual direction, then implement it in a preview you can use.
Review user journeys, mobile behavior, performance and agreed security controls. Address issues before handover.
Release after approval. Transfer source code, documentation and agreed access.
Yes. Website packages include hosting and one .com domain for the first year. Renewals after the first year are charged separately.
Prepare your business name, a short description of your services or products, your logo if available, photos, and contact details. We help arrange the content.
Business Website takes about 1–3 weeks and Growth Website about 2–5 weeks once content is ready. Custom application timing and your revision allowance are listed in the quote before you order.
Yes, if you choose a package with an admin area. We provide guidance for the included updates, such as products, services, or photos.
Basic covers only basic monitoring, SSL/domain checks and monthly reports; it excludes managed backups, technical updates and incident handling. Business adds scheduled backups and controlled updates as agreed. Secure Care adds basic security checks and priority communication during service hours, excluding full pentesting and unlimited incident response. Security Review is a separate assessment with an agreed scope and written authorization.
A report of the checks performed, evidence for verified findings, and recommended fixes.
Yes. Send us your website address. We review it, then explain the recommended changes and their cost.
09 / Discuss a project
Business Website starts at $750, including hosting and one .com domain for the first year. Tell us about your business and target launch date. We will help you choose a package.
INQUIRY RECEIVED
Your inquiry is saved even if you do not open WhatsApp. The prepared message includes your name, service, package and reference. You still need to press Send in WhatsApp.
Done · Back to website ↗