Customer or partner review
“A prospect is asking how we protect their data and wants evidence before the deal moves.”
An independent scoped review, a signed report, and retest status you can put in front of the conversation.
Expert security review for AI-built apps
Your app ships fast.
Now prove who can access what.
Automated scanners find suspicious patterns. A senior security engineer reviews your highest-risk workflows — authorization, tenant isolation, payments, recovery — verifies what is actually protected, and delivers evidence-backed findings with a fix order you can act on.
Scoped · Signed · Evidence attached — or start with the free passive scan
CONFIRMED F-001 · HIGH
Cross-tenant record access via /api/projects/:id
A test role in Organization A retrieved records owned by Organization B. The ownership check compares user IDs, not organization membership.
request GET /api/projects/8121 · role: org-a-member
response 200 · record owner: org-b
fix enforce org membership in the server-side query
Scope note: validated with approved test roles inside the signed scope. Payment and recovery workflows were not tested.
Why teams ask for a review
Reviews start with a business event, not a generic worry.
Security becomes urgent when a deal, a launch, an audit, or a change puts real users, data, or revenue behind the answer. The review is scoped around that event.
How a review startsSensitive launch
“We are about to put real users, customer data, payments, or multiple organizations through this app.”
Verification of the highest-risk trust boundaries before exposure grows.
Compliance or audit preparation
“Our advisor, auditor, or customer wants application-security evidence.”
Current, scoped technical evidence that supports preparation — without claiming certification.
Material product change
“We added auth, billing, admin roles, exports, integrations, or a new backend.”
Focused revalidation of the trust boundaries that change touched.
Incident or near-miss
“We found something suspicious and no longer trust our assumptions.”
Scoped validation and remediation after the urgent event is contained.
General curiosity
“Can someone check whether anything obvious is exposed?”
Start with the Free passive scan below — and learn what a public view cannot establish.
What the review resolves
The questions automated tools cannot answer.
A route string in a bundle does not prove the route is open. A public key does not prove data is exposed. A missing header does not establish that a high-risk workflow is safe or unsafe. These decisions need source, context, and authorized validation:
What a reviewer examines- Can one customer access another customer’s records?
- Can a normal user become an administrator — or invoke an administrative action?
- Does every sensitive endpoint actually enforce authentication and authorization?
- Do Row Level Security policies match the tenant and organization model you intended?
- Can payments, credits, invitations, approvals, exports, or recovery flows be manipulated?
- Can several individually modest weaknesses chain into a material attack path?
How it works
From inquiry to signed report.
Nothing is tested before scope and authorization exist in writing. The inquiry itself collects no source, credentials, or sensitive data.
01
Inquiry
Tell us what changed and what is at stake. No source code, credentials, or sensitive data at this stage — and no commitment.
02
Scope and authorization
We agree on the workflows, roles, source handling, test access, and rules of engagement in writing before anything is touched.
03
Review and bounded validation
A senior security engineer reads the relevant code, traces sensitive workflows, validates or rejects findings, and performs only agreed, non-destructive testing.
04
Report, debrief, retest
You receive a signed scoped report, a live debrief, a prioritized fix plan, and retest status for the fixes you make.
What you receive
- Executive summary tied to your trigger
- Scope, access, exclusions, and review dates in writing
- Validated findings with result state, severity, confidence, and reproducible evidence
- Prioritized remediation plan in language your team can act on
- Live debrief with the decision-maker and the implementer
- Retest status for agreed fixes
- Signed scoped report — and, when useful, a limited customer-facing summary
One evidence standard
The conclusion is never stronger than the evidence.
Result state is separate from severity and confidence. Every report says what was reviewed, what was not tested, and what access would be needed for a stronger conclusion.
Read the methodologyConfirmed
Cross-tenant record access
An approved test role in one organization retrieved records belonging to another. Reproduced inside the signed scope.
Needs verification
High-risk credential pattern in a public bundle
The pattern is visible; provider role and current validity still need verification.
Informational
Supabase project URL and public client key
These values are commonly publishable; security depends on server-side policy.
Not tested
Row Level Security enforcement
Outside the agreed scope. “Not tested” is stated explicitly — it is not a passing result.
Products and roles
Expert review is the service. Automation supports it.
These are three products with different jobs — not a ladder you must climb in order. A qualified buyer can request a Human security review directly, without running the free scan first.
Core service · Available now
Human security review
Written scope, relevant source, and agreed test access — after identity, authorization, and handling terms are in place.
Role: A senior security engineer reviews the agreed high-risk code and workflows, validates material findings, performs bounded authorized testing, prioritizes remediation, and signs the report.
Boundary: Scoped, not exhaustive. Not a certification, a guarantee, or unlimited penetration testing.
Free entry point · Available now
Free passive scan
A live URL you own or are authorized to assess. No account required.
Role: A first look at what an ordinary visitor can observe: public bundles, credential patterns, source exposure, headers, and browser-visible configuration.
Boundary: Passive only — no logins, API calls, data queries, or authorization tests. A clean result is not a passing review.
Planned automation · Planned
Authorized source scan
Account, ZIP or read-only GitHub, written authorization, and verified domain control.
Role: Repeatable source-backed checks derived from patterns proven in real reviews, plus bounded runtime validation.
Boundary: Not equivalent to a Human security review. Not presented as live until it is operational.
The free scan, precisely
The Free passive scan observes; it does not explore.
It fetches the submitted page and assets that page references. It does not guess admin paths, call discovered APIs, query databases, log in, introspect GraphQL, or test rate limits.
Every report records what was observed, how the evidence was classified, what was not tested, and what kind of access would be needed for a stronger conclusion. That is the point: it shows you exactly where experienced validation begins.
Free passive scan
See what your live app exposes.
Send the live URL you own or are authorized to assess. The report shows the browser-visible evidence — and names the consequential questions a public view cannot answer.
No credit card. No signup. We only test what's publicly accessible.
Need a scoped expert review instead? Request a security review.