We find the holes in your app. Then we fix them.
Security check for yourapp.com
Made for apps built with
Every finding comes with the fix.
Sign a one-page OK.
Code and live site, by hand.
One pull request. You approve it.
Sign a one-page OK.
Code and live site, by hand.
One pull request. You approve it.
We check each user sees only their own data and files.
We check every page and action asks who you are.
We look for keys your users can see or git still remembers.
We check nobody gets paid features without paying.
We check a prompt can't make your AI leak data or run up your bill.
We check your packages and AI coding tools for known traps.
We check headers, preview links and forgotten subdomains.
We read your app's own rules and test them by hand.
Before you launch or raise
$950once
When a buyer asks for one
$2,950once
The letter states what we tested and when. It isn't a certification.
No. It's a pentest and a letter. Your auditor decides what counts.
We only test what you approve in writing, and we don't run anything destructive on live data. If you have a staging copy, we'd rather test there.
Not for the free check. It only looks at your public pages. For Lockdown, read access to your repo lets us send fixes as pull requests, and you approve every change.
Then your report says so, with what we tested and how. It isn't proof there's nothing to find. No test finds everything.
No. A person tests every area and checks every finding. We use tools to go faster, but a person decides what's real and what to fix.
One missing policy can expose every row to anyone with your anon key.
How a live key ends up in the bundle, and the order to rotate it in.
Every exported server action can be called directly.