Contact
A security audit starts with a free 30-minute call to set the scope (the Spot review starts at $680, the Standard audit at $1,900).
- I reply within 2 business days
- An NDA can be signed before our first call
- You never need to hand over key values or customer data
Q. What is the difference between a vulnerability assessment and a security audit?
A. A vulnerability assessment finds known weaknesses in the running app or the code. A security audit adds the design (who may touch which data) and the configuration, and ends with a fix plan. This service covers both, inside an agreed scope.
Q. Do you do penetration testing?
A. Yes. Within an agreed scope and window, dynamic testing reproduces real attack steps against the running app (automated scanning plus manual verification). It runs on staging by default; on production, the target, time window and stop conditions are agreed in writing first, and only methods that never modify data are used.
Q. How much does it cost?
A. From $210 for the pre-launch light review (for apps built with AI), through the spot review (from $680) and the standard audit that goes into the design (from $1,900), to the embedded fix that implements the remediation (from $4,800). Size and scope change the quote, which follows the free call.
Q. Can you review an app that is not built on Next.js or Supabase?
A. Yes. Web apps built with Rails, Laravel, Django, Go and others, plus AWS / GCP / Vercel configuration. For Next.js / Supabase, the specialist audit focused on RLS is the better fit.
Q. We have no staging environment, only production. Can you still audit it?
A. Yes. Reading the code sends nothing to production, and configuration is reviewed with a view-only role that changes nothing. Anything that sends traffic to production is agreed in writing first — target, time window, test accounts — and limited to methods that never modify real customer data.
Q. Will the audit make us secure?
A. Not “completely secure.” An audit finds and ranks the known high-severity risks in scope and reports them with a fix plan. The fixes themselves, plus regression tests and CI gates, are the remediation tier. What is out of scope and what remains is written into the report.
Q. Can you fix what you find?
A. Yes. The remediation tier covers the fixes, regression tests and a retest. You can also take the report and fix it in-house.
Q. What do you need from us?
A. Read access to the repository and any architecture notes you have. You do not need to hand over production secrets such as passwords or API keys; where access is needed, you issue a scoped account or a temporary key for the audit. An NDA can be signed before our first call.
If a form is not your thing, reach me directly at the address below.