REMEDIATION
We fix the findings.
Hand the dossier back and we clear it. Credentials rotated and purged from history, dependencies upgraded, missing tests written, access checks added. Fixed scope, priced from the findings.
FIND OUT WHAT YOU SHIPPED
Nobody has
read your code.
Alongside reads the whole repository the way a senior engineer would, usually in under 90 minutes. You get a graded report and a fix prompt for every finding.
Four doors, one room. Production software that money depends on, which no experienced engineer has gone through.
Finds the key in your git history
The CVE in your lockfile
The payload in your README
The missing critical tests that don't exist
The GDPR exposure nobody logged
WHAT YOU GET
A graded dossier.
One letter grade. Per-category grades under it. Ranked findings ranked, each with what's at risk and how to fix it.
CODE
C−
VISUAL
C
Code and visual are graded separately. A B+ backend with a C− interface is not a C+.
Secrets & repo hygieneD
SecurityC−
DependenciesD+
Tests & CIF
Code qualityB−
Business logicC
ReliabilityC+
Data & privacyC−
DocumentationB
28 FINDINGS · WORST FIRST
commit 16abaee · 214k lines
CRITICALAWS access key committed, still live in historyNEW
Anyone who has ever cloned this repository has the key. Deleting the file did not remove it. It is in 9b06873..16abaee, in deploy/aws.env.
FIX PROMPT
Remove deploy/aws.env from git history with git filter-repo --path deploy/aws.env --invert-paths, then rotate the AWS access key in IAM. It's exposed in commits 9b06873..16abaee, and rewriting history does not un-expose it. Add *.env to .gitignore and a pre-commit secret scan so the next one gets caught before it lands.
CRITICALNo ownership check on GET /api/invoices/:idNEW
Authenticated, but never checks the invoice belongs to the caller. Change the ID in the URL and you get another customer's invoice. api/invoices.mjs:41
HIGHPrompt-injection payload in README.mdNEW
Instructions addressed to a coding agent, planted in the install section. Anyone who points an agent at this repo runs them. README.md:120
HIGHCritical CVE in your resolved dependency treePERSISTS
Scanned against the lockfile, not the manifest: a transitive dependency four levels down. Nothing in the repo updates dependencies; no Dependabot, no renovate.
HIGHMoney handled in floats, not integer centsNEW
Totals, tax and refunds all use floating point, and refunds round with Math.round. Nothing in the test suite covers the money path, so the first off-by-a-cent dispute arrives from a customer.
MEDIUMAuth, billing and permissions have no tests at allPERSISTS
Coverage is reported as 71%: estimated, not published. The three modules where a bug costs you money contain no test files. CI exists and does not run the suite.
MEDIUM11 distinct grays, 7 spacing values and 5 font sizes across 14 screensNEW
There is no design system, which is the normal case, and it's why the app looks inconsistent. Measured across every screen at three device profiles.
+ 21 more. Every finding cites a file and a line. Unknown counts as risk, not a pass.
THE FIX PROMPT IS THE PRODUCT
Paste it. Don't study it.
Every finding ships with a prompt written for your coding agent: your files, your commands, your commit hashes. Included on every plan.
EVERYONE ELSE GIVES YOU THIS
"Rotate the exposed credential and remove it from history."
WE GIVE YOU THIS
"Remove deploy/aws.env from git history with git filter-repo --path deploy/aws.env --invert-paths, then rotate the AWS access key in IAM. It's exposed in commits 9b06873..16abaee, and rewriting history does not un-expose it. Add *.env to .gitignore and a pre-commit secret scan so the next one gets caught before it lands."
Paste it into Claude Code, Cursor, or whatever you use.
WATCH IT HAPPEN
Live findings, as they're confirmed.
Findings land the moment they're evidenced, so you can start fixing while the run is still going. File paths are never shown.
PHASES
- Clone into sandbox
- Discover stack & domain
- Your linter, your rules
- Test suite & coverage
- Dependency scan
- Secrets & git history
- Security & access control
- Logic, money & reliability
- Data & privacy exposure
- Grade & report
- Teardown
✓
Source & access key destroyed · sandbox wiped
If it dies you keep everything it found. Partial results are not an error.
THEN FIX IT
Fix it, then watch them go green.
Re-run. Resolved findings move into their own group, struck through. Everything is tagged new, regressed, persists or resolved against your last run.
C−
→
B+
Re-audit · 6 days later · 5 resolved, 1 persists, 0 regressed
✓AWS access key committed, still live in historyRESOLVED
✓No ownership check on GET /api/invoices/:idRESOLVED
✓Prompt-injection payload in README.mdRESOLVED
✓Critical CVE in your resolved dependency treeRESOLVED
✓Money handled in floats, not integer centsRESOLVED
·Auth, billing and permissions have no tests at allPERSISTS
Paste the prompt. Watch it go green. Two years with us shows two years.
BEYOND THE AUDIT
Or have us do it.
The audit is self-serve at $149. Everything here is quoted per engagement. Same engineers, same standards, applied to the codebase instead of a report.
BUILD WITH YOU
We work alongside your team.
Engineers in your repository and your standups. For when the team knows the domain but is short on time, or short one skill: security, payments, data, infrastructure.
BUILD FOR YOU
We build it and hand it over.
A new product, or a rebuild of what the last vendor left. Delivered graded, tested and documented, so whoever reads it next isn't starting from nothing.
Every engagement starts with an audit, so the scope comes from evidence instead of a guess.
Talk to us about an engagementWHO IT'S FOR
Same audit. Different reason you need it.
Nobody wakes up wanting a code audit. They want one on a specific day, because something happened.
You shipped fast. Now find out what you shipped.
Under 90 minutes, usually, and you know what's exposed, what's vulnerable, what's untested, and what to fix first. Each finding comes with a prompt. Paste, fix, re-run.
A customer just asked whether the code has been security reviewed.
- $149, not $3,000 and three weeks.
- Fix prompts on every plan. You don't need to be a security engineer to act on this.
- Credits never expire. Buy one audit.
- Most software earns a C. The grade means something when it improves.
- Answer your customers. "Independently audited" becomes a sentence you can say.
You've seen their demo. Nobody's audited the code.
You outsourced it because nobody in-house could build it, which is the same reason nobody in-house can check it. This is the independent read: what was actually delivered, graded and evidenced, written so you can follow it without being an engineer.
The people who built it are the only people who've read it. That's a reference, not a review.
- Delivered last week? Review it before the final invoice. Findings before payment are worth more than findings after.
- Running for two years? Nobody has read it since handover. The people who wrote it have moved on.
- Independent. The vendor doesn't grade their own homework.
- Zero time from your developers. If they were too busy to build it, they're too busy to audit it.
- Evidence, not opinion. Every finding cites a file and a line. Disputing one means disputing a line number.
- Hand them the fix prompts. The list, plus exactly how to fix each item. Cheaper than a dispute.
Twenty years of code, reviewed this afternoon.
Nobody has a month to spare and you don't need one. Point it at the repository and get a graded assessment of security posture, dependency risk, data handling and test coverage, with a file and a line behind every claim.
What forces this is rarely a bug. It's a questionnaire.
- Zero engineering time. Nothing to integrate and nothing to wire into CI.
- Age doesn't matter. If it's in git, we read it.
- The questions an auditor asks: PII in logs, encryption at rest, retention and deletion, consent, access control, licenses, who can merge to main.
- A prioritized roadmap. Phase 0 is one person for one sprint.
- A trend line for the board. Exposure with evidence, not certification.
Every project reviewed monthly, without anyone remembering.
Pick a day. We audit on that day. You get a grade, a trend line and a list. If something breaks we pause and pick it back up instead of emailing you the same failure twelve times.
It's the old projects, the client work still running, the thing the contractor built.
- Automated monthly re-audits per project, on a day you choose.
- A grade trend line your client can see too.
- Unlimited seats, shared credits. Everyone on the team can read a report.
- Roles that keep billing with the owner while the team works.
- The quote is honored. A report is never held back for a top-up.
A consulting-grade assessment your security team will accept.
Point-in-time, evidence-based, commit-pinned. Every finding cites a file and a line. Every run happens in a disposable VM with no network out and no credentials inside it.
We're not a PR gate. That's the incumbents' product and a different budget.
- Whole repo, not the diff. Your PR tools already cover the diff.
- Evidence: file, line, commit, reproduction step.
- One ephemeral VM per run, destroyed on every exit path.
- Egress denied by default, including vendor telemetry.
- Roles, attribution and an append-only history that survives departures.
- Seven VCS hosts, self-hosted Forgejo, Gitea and Bitbucket Data Center included.
EVERYTHING IT CHECKS
Thirteen code dimensions. Fifteen visual ones.
The read a senior engineer would give the whole repository, plus a graded pass over every screen on real device profiles.
THE CODE AUDIT
Secrets & repo hygiene
Keys, tokens and credentials in your code and in your git history, including ones you deleted. .gitignore gaps tested rather than eyeballed: *.env doesn't match .env.local, and that one catches everyone.
Security
Auth that's opt-in when it should be default-deny. Missing ownership checks. Rate limiting, input validation, webhook signatures, CORS and CSP. Secrets shipped in your frontend bundle, exposed source maps, cookie flags, token storage.
Your dependencies
A real vulnerability scan against your resolved tree, not your manifest. Whether you're pinned, whether anything updates them. Branch protection, required reviews, secret scanning, license compatibility.
Tests & CI
Coverage, and where the number came from: published, estimated or unknown, labeled as such. The high-stakes modules with no test at all. Whether CI actually runs the suite, or just exists.
Code quality
God files, mixed concerns, broken layering, dead code, silent fallbacks. Your linter, your rules. And whether anything makes anyone run it. A clean lint run over 400 eslint-disable comments is a misleading green, and we say so.
Business logic
Money in floats instead of integer cents. Rounding, timezone and DST. Double-charge and idempotency. Whatever the high-stakes invariant is in your domain. We work out what you do first.
Reliability
External calls with no timeout, retry or circuit breaker. Transactional integrity. Silent success on failure: the worst bug class there is. And whether you'd know if it broke.
Data & privacy
Datastore rules that aren't default-deny. PII in logs and error traces. Encryption at rest, retention, right-to-deletion, consent.
Documentation
Does your README's install actually work? Docstring coverage, comment density, what's missing. Graded in every report, because onboarding cost is a real cost.
Prompt injection
Payloads planted in source, READMEs, and the output of your own test suite. A payload in your test output is itself a finding.
THE VISUAL AUDIT
Graded A–F on every screen and every device. Weighted double:
Visual hierarchy ×2
Responsiveness ×2
Accessibility ×2
SpacingTypographyColorAlignmentComponentsIconographyMotionEmpty statesLoading statesError statesDark modeDensity
- It drives the running app, signed in, through real flows.
- Real device profiles: user agent, pixel ratio, touch. Catches tap targets and DPR bugs a resized window never will.
- Devices named for what they catch: "Small phone, where layouts break first."
- It grades empty, loading and error states, the ones nobody designs.
- The Jobs filter: every finding has to survive "can this be removed without losing meaning?"
"11 distinct grays, 7 spacing values and 5 font sizes across 14 screens."
Most apps have no design system. That's the normal case, and it's why the app looks inconsistent. We measure it instead of complaining about it.
TRUST
Your code never leaves a machine we throw away.
Cloned into a locked-down VM with no network out, destroyed when the report is out. Success, failure or crash.
Your credential is never in the sandbox.
Not encrypted, not wiped afterwards. Never there. It's attached to the clone request from outside the machine, for your one repository. Nothing in the VM could steal it.
Read-only, repo-scoped credentials. No SSH deploy keys. Grant more access than we need and we'll tell you when you do it, with instructions for narrowing it.
We never stand up your application.
No server started, no deploy, nothing touching your infrastructure. Once the review starts the AI can't run anything at all: the tools are gone.
Your own test suite runs inside the sandbox so we can tell you whether it passes. Your application doesn't.
Nothing is kept.
Cloned fresh, audited, destroyed. Every run, including the ones that crash.
We keep the report. That's your history. Nothing else.
THE OBJECTION YOU'RE HOLDING
"We've never had a problem."
That you know of.
A key in your git history doesn't page anyone. A missing ownership check doesn't crash; it serves the wrong customer's data to whoever edits the ID in the URL. A dependency with a critical CVE runs perfectly until the day it doesn't.
Nothing going wrong is not the same as nothing being wrong.
You don't conclude the smoke alarm works because the house hasn't burned down. 90 minutes and $149 turns "probably fine" into a list.
Find out · $149PRICING
One credit. One audit. $149.
No seats, no minimum, no card left on file. Bigger repos cost more and you see the price before you commit: 200k lines is 1 credit, 400k is 2, 1M is 4.
START HERE
One audit
$149
One repository, one commit, one report.
Up to 200k lines. You see the price before you commit, and the report is yours whatever it finds.
Audit my repo · $149Under ninety minutes, and the fix prompts come with it.
BUY MORE THAN ONE
Take the Starter Pack if you intend to fix what the first audit finds: it covers the audit, the re-audit and the crawl that maps your app.
SUBSCRIPTIONS · FOR PEOPLE WHO WANT IT HANDLED
Indie1 / mo$135
Studio4 / mo$500
Agency13 / mo$1,495
Enterprise—Talk to us
Subscribers get automated monthly re-audits. That's the reason to subscribe. Everyone else buys packs.
Compare the plansYou see the price first.
We count your repository before the audit starts, so the number is on screen before you spend anything.
Purchased credits never expire.
Buy one audit and use it next year.
Every finding comes with its fix.
A prompt you paste into your own coding agent, on all of them, never behind an upgrade.
OBJECTIONS
The reasonable ones, answered.
"We outsourced it and it's fine — they're a good agency."
Probably true. And they graded their own homework, which is the one thing a good agency can't do for you.
This is a second opinion, the same reason you'd get a house survey from someone who isn't selling it. If they're as good as you think, you get a report that proves it. If they're not, better before the final invoice than after.
"It's twenty years old — surely it'll just fail everything?"
Old isn't bad, and the grade is honest either way. Long-lived systems usually beat their owners' expectations, because two decades in production means users found the real bugs.
They score badly on dependencies, secrets in history and test coverage. All three are fixable without touching architecture, and all three are what an auditor asks about first.
"I already have CodeRabbit / Greptile / Snyk."
Those review pull requests. They've never looked at the 40,000 lines that were there when you installed them. We read the whole repository, once, properly.
"Can't I just ask Claude to review my repo?"
You should. What you'll get is a chat log. What you won't get is a whole-repo pass with parallel workers, your real linter and test output, a live dependency scan, a grade you can compare next month, and a report you can hand a client. We also run in a locked-down VM, because pointing an agent at your code with the internet open is how prompt injection wins.
"I'm not giving you access to my private repo."
Read-only, one repo, and the part nobody else can say: your credential never enters the machine that runs the audit. It's attached to the clone request from outside. Nothing in that VM could steal it.
Grant us more access than we need and we'll tell you at the moment you do it, with instructions for narrowing it.
"What happens to my code?"
Cloned into a fresh disposable VM, audited, destroyed. Every run, crashes included. We keep the report and nothing else.
"$149 seems like a lot for a report."
A human audit is $3,000 to $50,000 and takes three weeks. You're buying the fixes, not the report: every finding comes with a prompt that repairs it. Most people clear the list in an afternoon.
"What if it finds nothing?"
It won't. We've never audited a codebase that graded above a B. Most earn a C.
"What if the audit breaks halfway through?"
You keep everything it found and we retry without charging again. If it produces nothing, your credit is released in full.
"Will it tell me my tests fail when they just need a database?"
No. If your suite can't run in a clean environment we say that, with the output. We never report "your tests fail" when the truth is "your tests need something we don't have." A suite only its author can run is still worth knowing about.
Find out what's actually in there.
Audit my repo · $149No subscription, no seats, and no card left on file afterwards.