Security audit

Find the security holes in your app and fix them this week

Agents and a senior engineer try to break in the way an attacker would. You get proof of each hole, and the worst one comes back fixed

No serious hole found? You don't pay

$490 for the audit and your worst hole fixed, in 2 days

Security audit

billflow-app

4 holes found, with proof

Anyone can read your invoices

GET /invoices: 200, 1,240 rows, no login

Fixed in #41

Live secret key in the browser

main.js:1 contains sk_live_51N...

Critical

Fake payments are accepted

POST /webhook, forged signature: 200

Critical

Any user can open the admin panel

GET /admin with a user token: 200

High

100+ products delivered

Start small, go as far as you need

Every step delivers something real, at a fixed price and date. Nothing takes longer than 3 weeks

Start here

Audit and worst hole fixed

$490

2 days

Every hole ranked by risk with proof, and the worst fixed as a pull request

All critical holes fixed

$1,900

1 week

Every critical and high-risk hole fixed in your repo as pull requests

Audit on every release

$3,900

2 weeks

All fixes, plus an agent that checks each new release for new holes

1
Give us read access

Your repo, your database settings and a test account. No production data needed
2
See the proof

Each hole comes with what we could read or do through it, and how to close it
3
Close them

We send pull requests, or your developers work from the list