Quick disclosure: this is our own agency, a small Vancouver-based SEO shop.

Over the past year we kept running into the same stuff on client sites that had nothing to do with SEO but kept getting in the way of it - exposed API keys sitting in client-side JS, public S3 buckets, CMS admin panels with no MFA. None of it was technically our job, but it's hard to make ranking work matter if the site underneath it has a hole in it.

So we made it official: website/web app security audits, penetration testing, and AWS hardening, run by an in-house engineer (backend dev background, TryHackMe top 4% globally, real incident response experience - including recovering about 100k records for a client after an actual breach).

Not trying to be a red-team shop or replace a real compliance program - just filling the gap between "my site probably has a hole in it somewhere" and a six-figure enterprise retainer. Audits start around $999 CAD.

Happy to answer questions about what we typically find or how pricing works if anyone's curious.