Vanorika Technologies
Software and security engineering, Harare
We build the systems your business runs on. Then we prove they hold.
Software and security engineering from Harare. Websites, custom systems and apps, built with the security testing most studios skip, for businesses in Zimbabwe and abroad.
- You work directly with the engineer: CompTIA PenTest+ and CompTIA Security+
- Written scope and a fixed quote first
- Code, domains and accounts handed to you
Free, in about 30 seconds
How exposed is your website right now?
Enter your domain for an instant, plain-English snapshot. You can download it as a PDF.
- HTTPS and redirects
- Security headers
- Email spoofing protection
- Privacy policy
Business Transformation Lab
Start with the problem, not the service.
Pick what you want to change and answer a few quick questions. You get a starting plan with real prices, and you can send it to us without typing it again.
- Challenges
- A few questions
- Your plan
What would you like to change in your business?
Pick as many as apply.
Nothing picked yet.
What makes us different
Most studios build the website and hope nobody looks too closely. We build it, then test it the way an attacker would, and hand you the written proof before it goes live.
Live work you can visit
Real sites, running for real businesses. Click through and judge the work yourself.
Website and booking system, Harare, Zimbabwe
Pearlsard Travel and Tours
A travel agency trading since 1984 needed a site that turns browsers into booked trips, not just phone calls.
What we built
- Trip search and destination pages
- Packages with clear per-person pricing
- Enquiry and booking flow
- An admin area to manage bookings
More client sites, live today
- AfriScience GroupSouth AfricaTraining platform: full course catalogue, schedules, brochures and a staff admin areaafrisciencegroup.com (opens in a new tab)
- ISP TrainingsPretoria, South AfricaExecutive training site: course catalogue, session calendar and bookingsisptrainings.co.za (opens in a new tab)
- BMC TrainingSouth AfricaCorporate training site: course catalogue with downloadable brochuresbmctrainings.org (opens in a new tab)
- LTC ConsultantsPretoria, South AfricaTraining course site: catalogue, calendar, venues and registrationltcconsultant.co.za (opens in a new tab)
- EasyUphillSouth AfricaBrand identity and corporate training websiteeubiz.co.za (opens in a new tab)
- Creditree MicrofinanceZimbabweMicrofinance website: loan products and enquiriescreditree.co.zw (opens in a new tab)
Kept confidential, as it should be
Security clients are never named and their findings are never published. Here is the shape of the work. The sample report shows what you would receive.
We also build and run software of our own.
Booking, AI reception, lead verification, business management and stock control. Each one runs on iPhone, Android and desktop, and installs to the home screen like an app.
- SlotlyOnline booking for appointment businesses(opens in a new tab)
- CallvaleAn AI receptionist that answers calls and books(opens in a new tab)
- LeadOSFind and verify the right business contacts(opens in a new tab)
- Slotly booking pageClients pick a time in seconds(opens in a new tab)
- ZenvoraAccounting, inventory, POS and CRM in one(opens in a new tab)
Your whole business on one screen.
Try this one: change the date range, hover the chart, watch orders arrive. Ours are built around the numbers you actually run the business on.
Overview
LiveRevenue
$48,949
Orders
2,015
Average order
$24.29
Low stock items
7
Reorder soonDaily revenue
Revenue by branch
- City centre$16,643
- Avondale$13,216
- Borrowdale$10,769
- Online$8,321
Latest orders
- Rice 10 kgOnline · 3 min ago Paid$59
- Cooking oil 2 LCity centre · 6 min ago Paid$56
- Cooking oil 2 LBorrowdale · 9 min ago Paid$63
- Bread flour 5 kgOnline · 12 min ago Paid$38
- Maize meal 10 kgOnline · 15 min ago Paid$30
Exposure overview
demo-store.exampleExposure score
6 open findings, one of them critical.
- Critical1
- High2
- Medium2
- Low1
Monitoring feed
Attack chain
An attacker could walk from the website to customer data.
Findings
VT-01 · admin.demo-store.example · Open
Risk: Unlimited password guesses against the account that controls every order and customer.
Fix: Lockout after repeated failures, rate limiting and a second factor for every admin.
VT-02 · api.demo-store.example · Open
Risk: Any signed in user could download the full customer list, names and phone numbers included.
Fix: Role check on the export endpoint, with the access logged.
VT-03 · demo-store.example (DNS) · Open
Risk: Fake invoices could be sent to customers from an address that looks exactly like the shop's.
Fix: SPF, DKIM and a DMARC reject policy published and monitored.
VT-04 · www.demo-store.example · Open
Risk: A known, published weakness that automated tools look for on every site.
Fix: Plugin updated and an update schedule agreed.
VT-05 · www.demo-store.example · Open
Risk: Nothing stops injected script from running if any input on the site is unsafe.
Fix: A strict policy deployed in report mode, then enforced.
VT-06 · www.demo-store.example · Open
Risk: Tells an attacker exactly which software to look up.
Fix: Owner chose to accept this for now; recorded with a review date.
Real projects are built the same way, around your own sales, stock and staff data, with logins per role, exports and alerts when something needs attention.
Custom softwareWhere would an attacker start?
Pick any part of a typical business to see what is usually at risk there, then follow it through to how an authorised assessment, its report and the retest work.
Web application
Logins, dashboards and portals: where customer records actually live.
Common categories of risk
- Broken access control: one user reaching another user's data
- Weak login, password reset and session handling
- Injection and the other OWASP Top 10 categories
Testing only ever happens with written authorisation and an agreed scope.
Build it, then secure it.
One accountable engineer across the whole job, so security is part of the build rather than a separate invoice later.
How pricing worksGet a sense of price and risk before you talk to anyone.
Project estimator
A starting figure, not a quote.
From
Starting from $250
Every project gets a written scope and a fixed quote. Work starts once the commitment fee is paid.
Five steps, and you always know which one you are in.
- 01
A short call
20 to 30 minutes on WhatsApp, a video call or in person in Harare. No commitment.
- 02
Scope and commitment fee
A written scope with a fixed price. Paying the commitment fee books your slot and starts the work.
- 03
The work
Weekly written updates on builds. Serious security findings reported as soon as they are found.
- 04
Handover
Websites typically live in one to two weeks. Penetration test reports within 3 working days of testing ending.
- 05
After launch
The same engineer, on the same WhatsApp, for questions, fixes and follow-up.
Built for clients outside Zimbabwe from day one.
Your hours overlap with ours
Harare is on UTC+2: the whole UK and European working day, and the US East Coast morning.
Everything in writing
Scope, decisions and updates by email or WhatsApp, with calls when they help. Nothing depends on being in the room.
You own what you pay for
Source code, domains, hosting accounts and documentation are handed over to you, not held back.
Tell us about the project
A few lines is enough. We read every enquiry personally and reply within one working day.