Find what’s broken before someone else does.
A rapid, technical security and code-quality audit for applications and platforms — from solo-founder MVPs scaffolded with Cursor, Lovable, Bolt, v0, Claude Code, or Replit, to funded startups shipping production SaaS. Comprehensive prioritized report with concrete patch suggestions in ~5 business days.
30-minute call. No pitch. Fixed-fee SOW after.
Vibe-coded apps, indie SaaS, and funded startups.
Whether your codebase was scaffolded by an AI tool, hand-written by a small team, or accreted across two years of fast shipping — the methodology is the same. We look at what actually matters: auth, authz, data boundaries, secrets, API exposure, injection surfaces, dependency posture, LLM tool-use risks, and how production is exposed to the internet.
- Solo founders shipping vibe-coded apps to real users
- Funded SaaS with paying customers and growing surface area
- Indie developers about to launch and wanting a sanity check
- Pre-SOC 2 startups looking for a posture baseline
- Teams shipping LLM-integrated apps with tool-use surfaces
- Healthcare-adjacent platforms handling PII or PHI
Three tiers. Fixed scope. Fixed fee.
Solo Founder Audit
Vibe-coded apps and indie SaaS
For solo founders, indie hackers, and small teams shipping AI-scaffolded apps from Cursor, Lovable, Bolt, v0, Claude Code, or Replit. We audit the surface area that gets you breached: auth, secrets, API exposure, database authz, and the obvious injection paths — then ship a prioritized report you can actually execute on.
Solo founders · Indie devs · Pre-revenue and early-revenue apps
- Authentication, session, and password handling review
- Authorization & access control boundaries
- Database authz / row-level security review (Supabase, Firebase, Postgres)
- Public API surface, rate-limiting, and abuse paths
- Secret, API key, and environment variable hygiene
- Common injection surfaces (XSS, SQLi, SSRF, path traversal)
- Dependency posture and known-CVE scan
- LLM tool-use and prompt-injection review (if applicable)
- Prioritized remediation report with concrete patch suggestions
- 30-minute walkthrough call to review findings
- Manual penetration testing or active exploitation
- Compliance certification (SOC 2, ISO, HIPAA attestation)
- Implementation of fixes (available as add-on)
Funded Startup Audit
Production SaaS shipping to real customers
For funded startups with paying customers, a real production surface, and a team that needs a real security posture review. We dig deeper into architecture, cover multi-tenant authz, supply chain, deployment and infrastructure hardening, and ship a report your engineers, security lead, and investors can all read.
Seed–Series A SaaS · Multi-tenant platforms · Pre-SOC2 prep
- Everything in the Solo Founder Audit
- Multi-tenant authorization and data isolation review
- Architecture and threat-model walkthrough
- Deployment, CI/CD, and infrastructure hardening review
- Supply chain and dependency posture deep-dive
- Webhook, queue, and event-driven surface review
- Logging, observability, and audit-trail review
- PII / sensitive-data handling and storage boundaries
- Pre-SOC 2 / pre-compliance gap notes (informational)
- 60-minute walkthrough call with engineering team
- Two weeks of follow-up Q&A on findings
- Formal penetration test (we can refer trusted partners)
- Compliance attestation or certification
Enterprise / Custom Scope
Larger surface, multiple repos, or specialized scope
Large codebases, multiple services, regulated environments, or specialized scope (LLM agents, payment surfaces, healthcare PHI handling). We scope to your surface area and ship a custom audit plan with the right depth, the right specialists, and the right deliverable.
Multi-repo platforms · Regulated environments · Specialized scope
- Pre-scoping call to map your surface area
- Custom audit plan with depth-of-coverage by area
- Multi-repo and multi-service coverage
- Healthcare / HIPAA-aware audit option
- Payment, billing, and PCI-adjacent review
- LLM agent / tool-use deep-dive option
- Executive summary suitable for board or investor review
What we actually look at.
Ten focus areas across the application surface. We prioritize what attackers actually exploit — not a checklist of theoretical risks.
Authentication & Session Integrity
How users sign in, stay signed in, and what an attacker can do with a stolen token. Common ground zero for vibe-coded apps.
- ·Password storage, hashing, and reset flows
- ·Session tokens, JWT handling, and revocation
- ·OAuth, SSO, and third-party identity integration
- ·MFA posture and account-takeover paths
Authorization & Access Boundaries
Who can access what, and whether the rules actually hold across the API, the database, and the frontend.
- ·Object- and field-level authorization
- ·Multi-tenant isolation and cross-tenant leakage
- ·Row-level security (Supabase, Firebase, Postgres)
- ·Admin / superuser boundary review
API Exposure & Abuse Paths
Public surface area is where most apps leak. We look at what's exposed, what's rate-limited, and what's exploitable.
- ·Public endpoint inventory and surface mapping
- ·Rate-limiting, throttling, and abuse paths
- ·Webhook signature and replay protection
- ·Mass-assignment and IDOR risk
Secrets, Keys & Environment Hygiene
AI scaffolding loves to put secrets in client bundles. We look everywhere they tend to leak.
- ·Client-side bundle and source-map secret leakage
- ·Environment variable and .env hygiene
- ·Provider key scoping (Stripe, OpenAI, Anthropic, Supabase, etc.)
- ·Git history and accidental commits
Database Authz & Data Handling
Schema, authz, and how sensitive data flows through the system.
- ·RLS policies and policy coverage
- ·PII / sensitive-data inventory and storage boundaries
- ·Encryption at rest and in transit
- ·Backup, retention, and deletion posture
Injection Surfaces & Input Validation
Where untrusted input meets trusted execution. The classics, plus what's new in AI-scaffolded code.
- ·XSS, SQLi, SSRF, path traversal, command injection
- ·Server action and form action validation
- ·File upload validation and storage
- ·Deserialization and template injection
LLM Tool Use & Prompt Injection
If your app gives an LLM access to tools, data, or the user's session, this is the highest-risk new surface.
- ·Prompt-injection surfaces and indirect-injection paths
- ·Tool-use authorization and scoping
- ·Output handling and downstream execution
- ·Memory, context isolation, and data leakage
Dependency & Supply Chain Posture
Your codebase is mostly other people's code. We look at how exposed you are to it.
- ·Known-CVE scan across direct and transitive dependencies
- ·Lockfile integrity and pinning posture
- ·Build pipeline and CI/CD trust boundaries
- ·Third-party script and integration risk
Deployment & Infrastructure Hardening
Where the app runs and how it's exposed to the internet.
- ·Hosting and edge configuration (Vercel, Netlify, Cloudflare, AWS)
- ·TLS, HSTS, security headers, CSP
- ·CORS posture and origin allowlists
- ·Deployment and rollback safety
Observability & Incident Readiness
What you'd see if something went wrong — and what you wouldn't.
- ·Logging coverage and PII redaction
- ·Audit-trail completeness for sensitive actions
- ·Alerting on suspicious behavior
- ·Incident response readiness
Five days. Four steps. One report you can actually act on.
Scoping Call
30-minute call to map your stack, deployment surface, and the areas you're most worried about. We confirm scope and timeline, then send a fixed-fee statement of work.
Repo & Surface Access
Read-only access to the codebase (GitHub, GitLab, or a zip), plus production URLs and a brief stack inventory. No credentials needed.
Audit Execution
Manual code review across the scope areas, supplemented by tooling for dependency posture, secret scanning, and known-CVE detection. We don't run live exploits against production.
Report & Walkthrough
Comprehensive prioritized report — severity, impact, location, suggested patch — plus a walkthrough call to review findings with you and your team.
What you get at the end.
Prioritized Findings Report
Every finding tagged by severity (Critical / High / Medium / Low / Informational), with a description, location in the codebase, impact analysis, and a concrete patch suggestion.
Executive Summary
A one-page summary suitable for non-engineering stakeholders — your board, investors, or a security-conscious customer asking what your posture looks like.
Remediation Playbook
Findings grouped into actionable workstreams with effort estimates, so your team knows what to fix first and what can wait.
Walkthrough Call
A live review of every finding with your team. Solo Founder: 30 minutes. Funded Startup: 60 minutes, plus two weeks of follow-up Q&A on findings.
Critical findings get a same-day heads-up.If we find something that needs to be patched before the audit even concludes, you hear about it immediately — not in the final report.
Questions, answered.
Five days to a real security posture.
Book a 30-minute scoping call. We’ll map your stack, confirm scope, and send a fixed-fee SOW the same day. Then we get to work.
Book a Scoping Call