๐ค No AI, no automated scans. A real ethical hacker looks at your whole app by hand โ and tells you exactly what's wrong, in plain English.
~45%
of AI-generated code ships with security flaws.
300+
of 1,072 scanned vibe-coded apps leaked database keys to the browser.
172
let anyone delete data with no authentication at all.
The Four Tiers
Each tier goes one level deeper and needs one more level of access. Every tier ends the same way: a plain-English report, ranked by severity, each finding with what it is, why it matters, and how to fix it.
T1
The 10-Foot Audit
"Is it broken?"
- Click through every core flow and confirm things land where they should
- Break-test forms and inputs with junk, empty, and oversized values
- Watch the network tab for obvious leaks and client-side price/logic
- Mobile + desktop, plus error and broken-state handling
- Written findings report + 15-minute walkthrough call
Needs: access to the working app.
$199
starting out: $99
2โ3 days
T2
The Pen Test
"Can someone break in?"
- Everything in T1, plus:
- Auth testing โ can I reach another user's data, ride, or account?
- Hunt for exposed API keys, service credentials, and database access
- Broken access control / IDOR โ change an ID, see someone else's data
- Endpoint probing and business-logic abuse (e.g. tampering with a fare)
- Severity-ranked vulnerability report + walkthrough call
Needs: app + test account + written go-ahead, staging only, no real user data.
$499
starting out: $299
3โ5 days
T3
The Code Review
"Is it built right?"
- Everything in T1 + T2, plus:
- Read the code โ auth logic, database rules, and permission model
- Secrets handling โ hardcoded or committed to the repo?
- Architecture + data model, and where PII and location history live
- Dependency, config, and payment-flow review
- Full written audit with file/line references and specific fixes
Needs: read-only repo access. The deepest look โ catches what the outside can't see.
$999
starting out: $599
5โ7 days
T4
The Fix
"Make it right."
- Stop auditing, start fixing:
- Hands-on remediation of the findings from T1โT3
- Production hardening โ secrets, auth, and access control
- Re-test after fixing to confirm each hole is actually closed
- Two-week support window + a "here's what I changed" summary
Needs: repo access + agreed scope. Fixed price only after T3 sizes the work.
$125/hr
or fixed from $1,500
1โ3 weeks
Most founders start here
The Full Once-Over โ Tiers 1โ3
The complete outside-in and inside picture. For "just tell me if I'm okay to launch." Anchors the individual tiers and skips the "which one do I need?" question.
$1,499starting out: $899
Before You Ship & Beyond
Most founders test on production, with real users. These fix that. The setup is the easy yes; the monthly is where safe-shipping actually lives โ and it's the recurring line that pays the bills.
S0
Get-Set-Up
"Give me a safe place to test."
- A real staging environment, separate from production
- Realistic seed data that isn't your live users
- Secrets pulled out of the client and split from the code
- A one-page "how you ship from now on" checklist + 30-min walkthrough
Note: credited toward any audit or the Full Once-Over. Complex/custom stacks quoted to $900โ1,200.
$499
the front door
2โ4 days
S1
Shipping Safety
"Keep me safe every time I ship."
- Keep staging in sync with production
- Refresh seed data so tests stay realistic
- Monthly smoke test across the core flows
- I'm your "I think I broke something" person before you push
Light tier: $79/mo โ keep it synced + monthly check, no on-call.
$149/mo
the recurring line
ongoing
S2
Show-Me Session
"Just show me how."
- One call โ turn on the preview/branch environment you likely already have
- Set the safe-to-ship workflow and never-test-on-prod habit
- A Loom recording so you can do it yourself next time
- No ongoing commitment (but it warms you up for Shipping Safety)
Note: cheapest door in. Great for the ones not ready to commit.
SW
The Standing Watch
NEW
"Stay secure as you ship."
- Every month, I review what you shipped โ new features, endpoints, and flows
- Dependency + exposed-secret monitoring, flagged the moment they surface
- A short written report each month + a walkthrough call
- Priority "is this safe to ship?" answers between reviews
Note: picks up where a one-time audit ends. Best paired with any tier.
$299/mo
the security retainer
ongoing
What Each Level Can See
From the outside (T1โT2)
- Broken flows and rough UX
- Keys and credentials leaking to the browser
- Data you can reach that you shouldn't
- Missing auth on endpoints
// an honest picture, from the outside in
Only from the inside (T3)
- Database rules and row-level security gaps
- Secrets sitting on the server
- Permission holes you can't reach as a normal user
- Architecture and data-model risk
// the full inside-out check
Straight talk: testing from the outside only catches what's exposed to the outside. I'll tell you plainly what I did and didn't check โ and I'll never tell you your app is "secure." I tell you what I found and what I'd fix. That distinction is the whole point.