The website is a collection of information services that function as a means of interaction either individually, in groups, or in organizations. The benchmark that makes a website good is a website that has a high level of security so that it can provide comfort for its users. Therefore all agencies try to provide the best through websites that are used as information services, one of which is the Super Indo Company. However, in the running process, there are disturbances on the website, such as bugs found and the absence of security standards applied to the website. The purpose of this research is to find alerts so that bugs are identified using the OWASP ZAP application and to find out the level of security applied to websites using the COBIT 5 standard or method. The results obtained from all activity processes get a capability level value of 3.42 or at the Established process level (a management process). The Super Indo company is already at a fairly good level in the website development process