conversion · search
Ecommerce brands
See where customers drop off, then fix it.
We find where shoppers leave, fix those spots, and help more people find your store.
The ecommerce setup01 / whoami
The founder, in plain text.
No pitch deck. Here is what I do, in the format I think in.
-
whoami
talal kashar · artery systems llc
-
cat ./background
cybersecurity professional. i saw the flaw in how businesses run and i work to fix it.
-
cat ./what-i-do
help enterprise businesses get found, get booked and save time
-
cat ./how-i-talk
straight answers, no jargon
-
./next-step
it starts with a business audit. last section, below.
02 / services
Pick the one that sounds like you.
Each has its own page with the details.
-
-
launch · baseline
Funded startups
A launch-week site with a security baseline.
A fast, polished site ready for launch, with the security basics set from day one, so the first press mention doesn't find the gaps.
What the package covers -
authorized · scoped
Penetration testing
Find the gaps before someone else does.
Testing of your website, apps and network against a written scope you approve and sign. You get a clear report of what to fix first.
How a test runs
03 / security
Security you can verify.
Measured on this domain on 2026-11-07. Run the same commands.
-
curl -sI https://www.arterysystems.com/talal | grep -iE '^(strict|x-frame)'
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-frame-options: DENY
-
curl -sI https://www.arterysystems.com/talal | grep -oE "(default-src|frame-ancestors) '[a-z]+'"
default-src 'self'
frame-ancestors 'none'
-
curl -s https://www.arterysystems.com/.well-known/security.txt
Contact: mailto:contact@arterysystems.com
Expires: 2027-11-07T00:00:00.000Z
-
cat ./public-work
watchpost: an open-source SIEM i built. ingest, detect, correlate, triage. 15 detection rules mapped to MITRE ATT&CK.
github.com/talalkashar/watchpost
sample · fictional target · not client work
- target
- shop.example
- finding
- any signed-in customer can read another customer's order (IDOR)
- severity
- medium · CVSS 3.1 6.5 · CWE-639
- reproduce
- GET /api/orders/1002 with the session of order 1001's owner returns 200
- fix
- check order ownership on the server
- retest
- same request returns 403. closed.
Every test: written authorization, defined scope and rules of engagement, findings with reproduction steps and severity, then a retest of your fixes. Approach aligned to OWASP WSTG and NIST SP 800-115.
04 / how it works
From business audit to a running system.
Four steps, in this order, every time.
-
Audit
You walk me through where the hours go. You get an honest read on what would help, and what wouldn't.
-
Plan
I write up the scope: what gets built, what it costs, when it's done. You read it, then we both sign.
-
Build
You see working pieces early, not one big reveal at the end.
-
Run
It goes live and keeps running. When something needs to change, you know exactly who to call.
05 / terms
What you can hold me to.
Every project runs on these three, from the first day to the last.
-
Progress you can click
You judge the work by things that run, not by status reports or months of silence.
-
Scope and price on paper
Both are written down and fixed before day one, so you always know what you are paying for.
-
Your signature comes first
Nothing is built or tested until the agreement is signed. For security work, that signature is the authorization.
06 / next step
Tell me what's slowing you down.
A business audit. You leave with a clear next step, whether or not we work together.
Pick a time