Find out what's broken before your users do.
A fixed-price review of your codebase and infrastructure. Every finding ranked by what actually gets you breached, with the fix written out.
Five working days. NDA first. No access to production required.
Five working daysFixed $500Findings you can hand straight to a developer
Brands
That Believe in us
Who this is for.
Not for you if: we're not a certified penetration testing firm and we don't sign off compliance audits. If you need a SOC 2 auditor or a formal pentest certificate, we'll point you at one.
What we check
Secrets & keys
API keys in the frontend, credentials in the repo, tokens in client-side code. The most common finding, every time.
Authentication & sessions
Who can log in as whom, what happens when a session expires, whether password reset can be abused.
Database access
Row-level security, and whether changing an ID in the URL shows someone else's data.
Payments & webhooks
Unverified webhooks, prices set on the client, subscription state that trusts the browser.
Dependencies
Known vulnerabilities in what you've installed, and what's abandoned upstream.
Infrastructure
Open buckets, permissive CORS, missing rate limits, error pages that leak stack traces.
What you get
A ranked report
Critical, high, medium. Ordered by what an attacker would actually reach first, not by scanner severity.
Each finding written out
What it is, how it would be exploited, where it is in your code, and the fix — with the code.
A walkthrough call
Thirty minutes with the engineer who did the review. Bring your developer.
A free re-check
Fix the criticals within 30 days and we verify them at no charge.
A sample finding.
One anonymised finding, exactly as it appears in a real report.
Supabase anon key with write access exposed in client bundle
The anon key was scoped with insert and update permissions instead of read-only, and shipped in the frontend JS bundle — where anyone can read it.
How it’s exploited:
- Open browser dev tools on the live site and find the key in the bundled JS.
- Use it with the Supabase client library directly, bypassing the app’s own UI.
- Insert or modify rows in any table the key has access to, with no rate limit or audit trail.
The fix — scope the anon key to read-only on public tables:
create policy "public read only" on public.orders
for select using (true);The anon key’s role should never have insert or update grants for tables users shouldn’t write to directly.
How it runs.
Access
Read-only repo access, a walkthrough of what the product does.
Review
Automated tooling first, then manual review of auth, data access and payments.
Report
Written, ranked, with fixes.
Walkthrough
Thirty minutes on a call, questions answered.
Case studies.
Pricing
Review + fixes
- We fix the critical and high findings ourselves
- Re-verified after fixing
- Priced after the review, not blind
Fixed price for codebases under roughly 50,000 lines and a single deployment environment. Larger systems quoted after a look. USD; EUR and GBP invoicing available.
We don’t build it and leave.
Every project can continue as a partnership — we keep running your software while you run your business.
How partnership works