V1.0-BetaAn Independent Review [ Of Code ] Nobody Wrote Alone
We're the engineers who read what the model shipped — auth gaps, edge cases, and everything else it skipped — before your users find it for you.
>Read → Flag → Fix. For every repo <
Fixed Prices. Nothing Discretionary.
Includes:
- Monthly full review
- Written summary of anything new
- Async advisory over email
- Dependency and CVE watch
Everything in Starter, plus:
- Weekly reviews
- 48-hour incident response
- Priority remediation on new findings
- A direct line to the engineer who audited you
Includes Everything in Growth, plus:
- Continuous monitoring
- 4-hour incident response
- Quarterly architecture and load review
- Team & collaboration features
- Pre-release review on major deploys
Minor & low-risk pack
£345
Everything below high severity, cleared out in the same pass.
Hardening pack
£445
Security headers, TLS configuration, access control on admin paths, dependency updates.
Compliance pack
£447
UK and EU: consent handling, data subject requests, privacy policy review.
Performance & load
£647
Load testing and architecture review.
Redesign
On request
Quoted on page count, functionality and integrations.
Have Questions? We've Got Answers
A written report covering every page and endpoint we review. Each finding has a severity, where it is, how to reproduce it and what to do about it. There's a plain-language summary at the front for anyone who doesn't write code. Fixes are a separate, separately priced step, so you're never paying to be told you have a problem and then cornered into buying the cure.
No. It's most of our work. AI writes code that runs, which isn't the same as code that's safe. The gaps are consistent enough that we know where to look first: auth that checks the wrong thing, keys sitting in the client bundle, endpoints with no rate limit, database rules left open from the first day of the project.
No. The audit is read-only. Nothing is changed, deployed or taken down. If you go ahead with remediation, we work on a branch, you review the diff, and it ships when you say it ships.
A single-site audit usually comes back within [X] working days. Remediation depends on what's in the report. You get the timeline with the findings, before you commit to anything.
You get that in writing, and you can hand it to a client, a customer or an investor. It happens less often than you'd hope.
Read access to the repo and a staging environment gets you the most depth. If that's not possible we can work black-box against a live URL, and you'll get less for it. NDA first if you want one, no argument.
Nothing, unless you want it. The retainer exists because code keeps changing, and the next thing you ship is written the same way the last thing was. Monthly or weekly reviews, and someone to call when something looks wrong.