PUBLIC URL ONLY · NO REPO ACCESS · RESULTS IN ~10 MINUTES
of audited apps had high or critical flaws
live apps exposed in a single incident
of generated solutions are both correct and secure
to a full audit, fixed price
— 02 / SELF-QUALIFICATION
CRITICAL
Your app takes payments
A single missing access policy turns a checkout into an open database.
CRITICAL
You store customer emails, files, or personal data
This is the exact pattern behind every leak in the news.
CRITICAL
Your API keys are in the frontend
If you can see them in DevTools, so can everyone else.
CRITICAL
Nobody ever turned on Row Level Security
It is off by default. It stays off until someone turns it on.
HIGH
You don’t know what happens if someone calls your database directly
Your UI checks are not security. They can be skipped.
HIGH
You have no backups, or you have never tested a restore
An untested backup is not a backup.
MODERATE
The AI “Try to fix” button keeps creating new errors
Each loop adds code nobody has read.
Recognize one of these? Check the public exposure first.
Run the free exposure scan
— 03 / AUDIT SURFACE
DATA ACCESS — Row Level Security on every table, policy correctness, public endpoint exposure, direct database reachability.
SECRETS — API keys and service credentials in the client bundle and in git history. Gitleaks · TruffleHog
AUTHORIZATION — Object-level access, IDOR, server-side validation behind every UI control.
STORAGE — Bucket policies, predictable file paths, public objects that should not be.
ABUSE RESISTANCE — Rate limits on auth endpoints, OTP expiry, CAPTCHA, email bombing.
CODE — Static analysis on your React / TypeScript and dependency vulnerabilities. Semgrep
OPERATIONS — Backups and a tested restore path, logging, SSL enforcement, network restrictions.
Benchmarked against the official Supabase production checklist and OWASP ASVS.
— 04 / FIXED PRICING
$0
Exposure Scan
Automated PDF from a passive public scan. X-01…X-09 exposure checklist.
RECOMMENDED
$490
Findings Review
3–5 page remediation plan within 2 business days after a 90-minute review, with hour estimates.
$2,500
Production Readiness Audit
12–20 page report, remediation plan, fixed-price implementation quote, and one retest.
from $5,000
Remediation Sprint
We implement the findings and retest against section 6 of the report.
CUSTOM
Enterprise
Multi-app scope, compliance mapping, team walkthroughs, and procurement-ready delivery.
Not sure which level you need? Start with the public scan.
Run the free exposure scan
— 05 / FIVE-DAY SLA
DAY 1 — Scope and access. Read-only access to your project. No changes, ever.
DAY 2 — Automated pass: database linting, secret scanning, static analysis, dependency audit.
DAY 3 — Manual pass: authorization logic, access policies, the paths a scanner cannot reach.
DAY 4 — Operations: backups, restore test, limits, logging, cost and scaling risks.
DAY 5 — Report and walkthrough. Findings, severity, the fix for each one, and a fixed price to do it.
— 06 / WORKING TERMS
We don’t need your repo to start. The free scan runs on your public URL alone.
Read-only, always. We never write to your database or deploy anything during an audit.
Fixed price, no hourly billing that spirals out of control. You know exactly what you’ll pay before we start.
The report is yours either way. Hire us, hire someone else, or fix it yourself. No lock-in.
If you don’t need us, we’ll say so. Some apps are fine. We’d rather tell you that than sell you a sprint.
NDA before anything. Signed before we look at a single line.
— 07 / FAQ
01 What if my code is a mess?
That is exactly what the audit is for. We separate security risk from maintainability debt and give you an ordered remediation plan.
02 Do I need to rebuild from scratch?
Rarely. Most apps have salvageable parts. We identify what can stay, what must change, and the safest order to do it.
03 Can you work with Bolt, Replit, or Base44 too?
Yes. The audit follows the deployed architecture, data layer, authorization model, and code — not the builder used to create it.
04 How is this different from the platform’s own security advisor?
Platform advisors catch known configuration issues. We also test authorization logic, direct access paths, operational readiness, and the parts automated scanners cannot reach.
05 You’re not in the US — how do we work together?
Async-first, with a scheduled kickoff and report walkthrough. Scope, access, evidence, and deliverables are documented in writing.
06 What do I actually get?
A severity-ranked report, evidence for each finding, the concrete fix, a remediation sequence, and a fixed-price option to implement it.
07 What if you find nothing?
Then the report says so. You still get the tested scope and evidence, and we do not manufacture work to sell a remediation sprint.
— 08 / START WITH WHAT’S PUBLIC
Free, in 10 minutes, with no repo access. Start with the exposure scan and decide what to do next from evidence.
PRODUCTION SECURITY · FIXED SCOPE · READ-ONLY