Your development agency marks its own homework. Here is what that costs.

You paid an agency to build your platform. They told you it was finished and secure. The only people who can confirm that are the people you just paid. In every other industry that handles risk, we solved this a century ago.

This is not about dishonest agencies

Almost every agency we have seen work is competent and acting in good faith. That is exactly why the problem is hard to see.

When a developer builds an access control system, they hold a mental model of how it works. When they later test it, they test that model. The endpoints they think of are the endpoints they built deliberately. The ones that leak are almost always the ones nobody was thinking about, which is precisely why they leak.

Aviation, medicine, construction and accountancy all reached the same conclusion. The person who did the work is not the person who signs it off. Not because practitioners are untrustworthy, but because self review does not find the class of error that matters.

What it looks like in practice

Here is a real sequence from one engagement on a UK tax platform, anonymised.

We found four areas where an account with no active subscription could reach paid features, including filing a live return. The agency fixed it properly and quickly, with a server side check across the endpoints named in our report.

Then we went back to confirm the fix, and found five more endpoints of exactly the same class, sitting right next to the ones they had just patched.

They fixed the list they were given. Nobody asked what else had the same lock missing. That question is the entire job, and it is almost impossible to ask about your own work. The full sequence is here.

Five questions worth asking your agency

You do not need to be technical to ask these. You need to listen to the shape of the answer.

Who tested this, and do they report to the person who built it?

A good answer names a person or a firm outside the build team. A vague answer about the team testing thoroughly means nobody independent has looked.

Can a customer reach another customer's data?

Ask how they know. The answer should describe a test they ran, not a design they intended. Intent and evidence are different things.

Can someone who has not paid reach the paid features?

Specifically, if you bypass the interface and call the API directly. A great many paywalls are enforced only in the front end, which stops nobody who is actually trying.

When were our HMRC fraud prevention headers last reviewed?

If your product files to HMRC this is a legal requirement carrying a £3,000 penalty and, on continued non compliance, loss of API access. The date is the answer. Detail here.

What did you decide not to do, and why?

This is the best question on the list. Every real build has deliberate shortcuts. An agency that can name theirs is being straight with you. An agency that says there were none has either forgotten or is managing you.

When it is worth getting checked

• Before the final payment milestone. Maximum leverage, maximum relevance, and the fee is a rounding error against the build cost.
• Before you switch agencies or bring it in house. You are about to inherit this. Find out what it is first.
• When a customer sends a security questionnaire. Enterprise procurement routinely asks for a recent third party test report, and the deal stalls until one exists.
• Before an ISO 27001 or SOC 2 audit. Neither standard literally mandates a penetration test, but you will not pass a credible audit without evidence of technical vulnerability testing.
• After anything went wrong that nobody caught. The incident is rarely the problem. Nobody watching is the problem.

What an independent check is not

It is not a replacement for your developers, and it is not an insult to them. We do not write your code and we will not fix what we find, because the moment we do we are marking our own homework and the independence you paid for is gone.

Your agency builds. Someone else checks. Then your agency fixes, and the checker confirms it. That loop is the whole thing.

If you want that on your platform, a Build Review is £2,500 and takes about two weeks.