Security audit · Web apps / SaaS
Authentication, authorization, tenant isolation, secrets, payments and cloud configuration — verified by reading the source code and the configuration. Beyond what a scanner catches, it covers the design gap no tool can judge: who is allowed to touch which data. Every finding comes with a prioritized fix plan.
Pricing: Spot review From $680 / Standard audit From $1,900 / Embedded fix From $4,800
We never say “completely secure.” An audit finds and ranks the known high-severity risks inside an agreed scope. What is out of scope, and the risk that remains, is written into the report.
Scope
Next.js / Supabase, and also web apps built with Rails, Laravel, Django, Go and others, plus AWS / GCP / Vercel configuration. Scope and depth are agreed in the first call and put in writing.
Methods
Tools find a lot, fast. But “may this user see this record?” cannot be judged without knowing the business rules. An audit uses both, for different jobs.
Timing
Before a beta launch
Even invite-only: once outsiders can log in, an authorization gap is a real incident.
Before real customer data goes in
Fix it while the data is still test data, and there is nothing leaked to chase.
Before adding file uploads
Storage permissions and public exposure are expensive to change later — URLs and existing files have to move.
Before adding payments
Webhook verification and double-processing protection belong before the first payment, not after.
Before an enterprise contract
So the security questionnaire can be answered with evidence.
After a major feature
New roles or a new tenant structure invalidate the assumptions of the last audit.
Specialties
If your stack is settled, the page for that stack is more specific about what gets reviewed.
RLS (row-level security), service_role key paths and tenant isolation, closed in design and code. A specialist audit built on a 1,000-repository field study.
For owners of apps built with Claude Code, Cursor, Lovable and the like — no need to read the code.
Your side of Vercel: environment variables, Preview vs. Production, Deployment Protection, the Firewall.
Permissions, sandboxing, MCP, hooks and managed settings, designed so a team can use it safely.
Who
Audits are taken on by Tomoda Hinata, a freelance full-stack engineer. Judge by the published research, tools and delivered work below, not by a title.
A static analysis of public repositories: 9.2% (91) of the 994 that ship RLS had a policy that checks sign-in but does not narrow rows to their owner — published after checking all 235 such policies by hand.
Scanners and defensive building blocks for Next.js / Supabase, published under the MIT license. Part of the automated detection used in an audit is something anyone can run locally.
All 221 APIs with 0 missing-authorization findings, proven across 4 rounds of self-conducted security review (static review → live testing → penetration testing), with every critical finding, including cross-tenant personal-data exposure, fixed.
Encrypted personal data, audit logs, a WAF and key-less CI/CD built into the initial design rather than bolted on.
Pricing
Prices are “from” anchors. Size, stack and scope change the quote, which follows the free call.
Spot review
Knowing your exact exposure before a release
Turnaround: ~1 week
From $680scoped per project
Standard audit
Shipping/operating a B2B, multi-tenant SaaS safely
Turnaround: ~2–3 weeks
From $1,900scoped per project
Embedded fix
Reaching “actually fixed, and it won’t regress,” not just detected
Turnaround: Scoped (a few weeks+)
From $4,800scoped per project
Each tier’s deliverables for Next.js / Supabase are on the specialist page; other stacks follow the same stages with the checks swapped for that stack. For an app built with AI where you only need to know whether critical holes exist, there is a smaller pre-launch review.
A vulnerability assessment finds known weaknesses in the running app or the code. A security audit adds the design (who may touch which data) and the configuration, and ends with a fix plan. This service covers both, inside an agreed scope.
Yes. Within an agreed scope and window, dynamic testing reproduces real attack steps against the running app (automated scanning plus manual verification). It runs on staging by default; on production, the target, time window and stop conditions are agreed in writing first, and only methods that never modify data are used.
From $210 for the pre-launch light review (for apps built with AI), through the spot review (from $680) and the standard audit that goes into the design (from $1,900), to the embedded fix that implements the remediation (from $4,800). Size and scope change the quote, which follows the free call.
Yes. Web apps built with Rails, Laravel, Django, Go and others, plus AWS / GCP / Vercel configuration. For Next.js / Supabase, the specialist audit focused on RLS is the better fit.
Yes. Reading the code sends nothing to production, and configuration is reviewed with a view-only role that changes nothing. Anything that sends traffic to production is agreed in writing first — target, time window, test accounts — and limited to methods that never modify real customer data.
Not “completely secure.” An audit finds and ranks the known high-severity risks in scope and reports them with a fix plan. The fixes themselves, plus regression tests and CI gates, are the remediation tier. What is out of scope and what remains is written into the report.
Yes. The remediation tier covers the fixes, regression tests and a retest. You can also take the report and fix it in-house.
Read access to the repository and any architecture notes you have. You do not need to hand over production secrets such as passwords or API keys; where access is needed, you issue a scoped account or a temporary key for the audit. An NDA can be signed before our first call.
A free call sorts out what to review, how deep, and by when. The quote comes after.
An NDA can be signed before our first call.