AUDITS 2 per month · solo · hand-driven

Security review for when
the business stakes change.

Fixed-scope, hand-driven testing for founder-led SaaS preparing for due diligence, an enterprise customer, or a sensitive launch. The work is authorized, reproducible, and built to end in fixes.

See pricing Scope a review
  1. 1Qualify the moment
  2. 2Agree written scope
  3. 3Authorize + deposit
  4. 4Test
  5. 5Deliver + fix
  6. 6Re-test

Who

Built for a real buying moment

You run a founder-led SaaS with paying users and a current reason to buy security: a transaction, an enterprise procurement cycle, a fundraise, or a sensitive change to the product.

The product has a reachable assessment surface—ideally staging, two test tenants, or a safe client-provided environment—and a founder or technical owner who can act on the result.

If there is no current business trigger, I will say so. If you have a mature security team or need a certification audit, a larger firm is a better fit.

What's included

What you actually get

The full engagement, itemized:

  • Security audit. Hand-driven testing across auth, the data layer, integrations, and URL-handling surfaces. Not a scanner dump. Methodology below.
  • Findings report. Per finding: CVSS 3.1 severity, reproducible repro, impact, and a concrete fix. Engineers can ship the patch without calling me.
  • Threat model. What an attacker can actually do against your specific architecture — not generic STRIDE boilerplate.
  • Remediation Q&A. 30 days of email support while your team fixes the findings. 24-hour reply window.
  • Free re-test. One round of verification on the original scope after you patch.
  • 12-class checklist. The twelve vulnerability classes I find most often in vibe-coded SaaS, with fingerprinting heuristics, hunt protocols, and copy-paste remediation diffs. Yours forever.
  • Optional co-authored writeup. If you'd like, we co-publish a sanitized post-fix writeup after the patch ships. Great for buyer trust.

Methodology

How I actually test

Operator-level questions, answered up front. If anything below doesn't fit your setup, we adjust on the scope call — this is the default.

Testing model
Grey-box by default: I work from a test account, your public docs, and a 30-minute architecture walkthrough. Black-box (no walkthrough) and white-box (source access) are both available; white-box typically surfaces 30–50% more on the same time budget.
Source access
Not required, but welcome. Read-only GitHub collaborator on a private repo, or a zipped snapshot. Source is reviewed manually plus a targeted Semgrep pass for the twelve classes in the checklist.
Environment
Staging strongly preferred. I will test production with written authorization if no staging exists, with destructive payloads explicitly excluded and a pre-agreed abort signal.
Authenticated testing
Two test accounts in separate tenants/orgs are the minimum — cross-tenant IDOR, RLS, and JWT-audience bugs need a second identity to prove.
Scope size
Focused sprint: one high-risk workflow or boundary. Due-diligence review: auth, tenancy, data flow, and up to 3 connector flows. Deep assessment: add a desktop/mobile client, multiple OAuth flows, or sensitive scopes — quoted after scoping.
Stacks I'm fluent in
Next.js / Node / TypeScript, Python (FastAPI, Django, Flask), Supabase / Postgres + RLS, Hono / Cloudflare Workers, Clerk & Auth.js, OpenAI / Anthropic agent code, Stripe webhooks. Other stacks on request — I'll tell you honestly if it's outside my fluency.
Intensity
A focused sprint is ~25–30 hours over 5 business days. A due-diligence review is ~40–60 hours. Deep work is quoted per engagement.
Re-test SLA
One re-test on the original scope is included. Scheduled within 5 business days of your "ready to verify" email, completed within 3 business days of starting.
Reporting format
PDF + a markdown bundle (one file per finding) you can paste directly into Linear / Jira / GitHub issues. CVSS 3.1 vector strings on every finding. Sample report on request.
Legal safe harbor
You provide written authorization (template supplied) before any testing touches your infrastructure. Mutual NDA optional. I carry professional indemnity cover; certificate of insurance on request.
What I don't touch
Denial-of-service, social engineering of your employees, physical access, and anything that would exfiltrate real customer data. Destructive payloads on production are off by default.

Pricing

Start narrow or go deep

Fixed price, no hourly. Quoted per engagement.

LIMITED · 3 LAUNCH SLOTS

Launch Triage

A 48-hour review of the one trust boundary most exposed by a launch: auth, tenant isolation, agent permissions, webhooks, billing, or URL fetching.

$495 prepaid
  • One critical surface, agreed in writing
  • Reproducible evidence and remediation guidance
  • One verification re-test
  • Staging preferred; no customer-data access
Claim a triage slot

Expand within 7 days and the full $495 is credited toward the $1,500 Focused Security Sprint.

Focused security sprint

$1,500

One urgent, high-risk workflow or trust boundary.

  • ~25–30 focused hours over 5 business days
  • Examples: tenant isolation, OAuth, billing, URL fetching
  • Full deliverable stack, single re-test included

Due-diligence readiness

$2,500–$3,500

A buyer-facing view of the product's material application risk.

  • Auth, tenancy, sensitive data flow, billing, and up to 3 connectors
  • Buyer-facing remediation summary
  • Source-assisted review available
  • Full deliverable stack, single re-test included

Deep assessment

$6,000FROM

More surface — desktop/mobile, multiple OAuth flows, sensitive scopes.

  • Network capture + binary review where applicable
  • Privacy-practice review & third-party processor analysis
  • Attack-chain narrative + remediation roadmap
  • Quoted per engagement after a free scoping call

Capacity: I take two audits per month. This is real — I'm solo and the work is hand-driven. Booking is first-come; if the current month is full, the next slot is whichever month opens next. The three Launch Triage slots are a temporary, narrower offer outside that full-audit capacity.

Process

How it works

  1. Fit and trigger check. Send the URL, business event, deadline, and risky workflow. I use public context only and tell you whether a focused review makes sense.
  2. Written scope and authorization. If we're a fit, I define the systems, accounts, exclusions, deliverables, price, and abort conditions. Sign and pay 50% to book.
  3. Hand-driven assessment. NDA in place, test account provisioned, you don't need to do anything while I work. No standups, no Slack interrupts, no calls.
  4. Report delivered. Full deliverable stack lands in your inbox. Balance due on delivery.
  5. Patch and re-test. Your team fixes; I verify within the included 30-day window.

Boundaries

What I don't do

  • Hourly billing. You buy outcomes, not my calendar.
  • Certification audits. I test the application; I don't issue SOC 2 or ISO certificates.
  • Mass scanning. Every audit is hand-driven.
  • Pentesting for enterprises with security teams. Hire a firm.

Questions

FAQ

How does the public-writeup policy work for paid clients?

Paid engagements follow coordinated disclosure. We agree the public-disclosure timeline together (90 days from the fix is the default, longer is fine). You choose whether the eventual writeup names you, anonymises you, or stays private indefinitely. The site shows existence of paid engagements only with your approval. ParakeetAI on the homepage shows what an approved-but-embargoed listing looks like.

And for the public writeups I see on this site?

The writeups currently published (Outrank) were not paid engagements. They were independent research on products I use, disclosed privately to the vendor first. When a vendor does not engage with a disclosure after good-faith attempts, the finding is published under the same responsible-disclosure timeline that Project Zero, Trail of Bits, and most security researchers operate under. If either vendor responds now, I'll happily add a "fixed in version X" note to the post.

What if you don't find anything?

You still receive the agreed coverage summary, threat model, prioritized observations, and evidence of what was tested. The engagement buys systematic coverage and decision-quality evidence, not a guaranteed vulnerability count.

Why is this cheaper than US security firms?

A traditional pentest engagement starts at $10k–$25k and is scoped for a different buyer. I'm a solo researcher running a focused methodology against a narrow target class. Less overhead, less scope, less time — lower price. The work itself is not cheaper.

Payment?

Card via Stripe Payment Link, sent with the quote. 50% on accept, 50% on delivery. USDC, USDT, or wire on request — reply to the quote and I'll swap the link.

NDA?

Yours or mine. I sign yours unredacted; mine is a one-page mutual NDA on request.

Get started

Tell me what changed.

Send the product URL, the business event, the deadline, and the surface you want covered. I'll reply with whether there is a sensible fixed scope.

scope a security review