I have a project that will eventually be posted as a public service online. Security is a big concern, and I don't have a lot of experience hardening systems and code for public scrutiny. Is there some established community that I can expose a test instance of my product to in order to test the security? Or has anyone had any experience organising a public "hack my server" session?
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
|show 2 more comments|
There are a lot of companies and freelance individuals who will do a pentest for you, for a price. Depending on what you're trying to secure (webapp, payment gateway, physical box, hosted VM, entire network, etc) there may be certain regulations which need to be followed. You'll also have to liase with your hosting provider, since they don't like random people sniffing around in their network.
A code security review, on the other hand, requires in-depth knowledge of your codebase and security concepts, so most companies hire a security developer (or contract one in) for this kind of role. They'll need to get comfortable with your entire application and network, then do a detailed analysis of any potential security issues within the code or infrastructure.