The vertical risks — authorization, RLS, tenant isolation — closed by design and implementation

Yes — honestly framed. The audit provides evidence for the app-layer technical controls of SOC 2 (CC6 family) / ISO 27001 (Annex A.8) that you can hand straight to an auditor or drop into a questionnaire (control mapping + remediation record). It is not a certification itself and does not replace a GRC platform (Vanta / Drata) or your people-and-process controls — it complements them. It's ideal for firming up the application side right before an attestation.

Aegis (OSS) automates the horizontal controls a library can correctly own (headers/CSP, rate limiting, CSRF, typed env, input validation) and only detects & warns on the vertical risks it can’t fix (authorization/IDOR, Supabase RLS design, tenant isolation, business logic). Actually closing those vertical risks is design judgment and implementation — that’s the audit. Detection (free OSS) and fixing (audit) are different jobs.

The authorization model and IDOR/BOLA; Supabase RLS policies (RLS-off, missing WITH CHECK, USING(true), over-broad anon grants, SECURITY DEFINER without a pinned search_path); service_role key paths and ownership checks; multi-tenant crossing; input boundaries (SQLi, SSRF, XSS, open redirect, etc.); and business-logic abuse of quantity, price, and state transitions. Aegis’s static analysis, RLS verification, and dynamic checks are the base; human review confirms the real risk.

Pre-launch light review from $210, spot review from $680, standard audit from $1,900, embedded fix from $4,800 — all “from” anchors, scoped per project. The exact quote depends on your app’s size, table count, and requirements; we scope it on a free intro call.

The ideas — authorization, input validation, defense in depth — are general and apply to many stacks. The deepest, fastest, safest work is on Next.js (App Router) × Supabase. For other setups, let’s scope it on a free intro call.

NDAs are fine. Dynamic checks (DAST) run only non-destructive, localhost-default, scope-locked, request-budgeted probes against staging/production you own — no destructive operations. The default design is to not receive secrets, and any required access is kept minimal.

No — don’t trust anyone who promises that. An audit systematically closes known high-severity risks and leaves regression-proofing behind (tests, CI gates). But security is continuous, not one-and-done; there is no “complete” or “absolute.” I close what can be closed, honestly, and state the residual risk.