If you have run the free checks, tightened your public surface, and worked through a checklist or two, the next question is a fair one: what does an actual security review involve, and is it worth paying for? This post walks through exactly what we look at, how the process runs, and what lands on your desk at the end. No scare tactics, no jargon, just what to expect.
When a review is worth doing
A review earns its place at a few predictable moments. When your product has grown past the MVP stage and now holds real customer data. When a larger customer is about to put you through their procurement process and you want to answer their questions honestly. Or simply before you scale, while fixing things is still cheap. The point of the timing is to find issues before someone else does, not after.
What we actually look at
A free Surface Check reads what your app exposes to the public internet. A full review goes where that check cannot, into the logic and configuration of the application itself. In practice that means:
- Access control, so one user cannot reach another user's data by changing a value in a request. This is the single most common serious flaw, and we cover it in broken access control, in plain English.
- Authentication, meaning your logins, sessions, and password reset flows, which we unpack in authentication, in plain English.
- Data handling, including the database rules that decide who can read which rows. For apps built on managed backends this is a frequent gap, as we show in the public database check.
- Secrets and configuration, the quiet gaps where a leaked key or a loose setting causes real damage.
- Business logic, the rules specific to your product that generic tools never understand.
How the process runs
The shape of an engagement is deliberately simple.
- Scoping. We agree what is in scope, what matters most to your business, and how we access the application. You know exactly what we will touch before we start.
- The review. We work through the application methodically, by hand, not just by pointing a scanner at it and printing the output. The difference matters, which is the whole argument in a list of vulnerabilities is not security.
- Findings and remediation. We prepare the fixes and hand them to your team to review and deploy, or apply them directly where you have authorised us to do so in writing.
What you actually get
The deliverable is written to be useful, not to pad a page count. You get a clear report of what we found, each issue rated by how serious it is and ordered so you know what to fix first. Every finding comes with plain guidance on how to fix it, not just a label. You also get an executive summary written for your own leadership team. If you buy a remediation block, we retest each fix inside it so you know it actually closed.
Built for startups, including the price
Most security reviews are priced and paced for large enterprises, which is why smaller teams skip them until something forces the issue. Ours is built for startups and fast-moving teams. And if a paid review finds nothing beyond what the free Surface Check already showed you, we refund the review fee. We would rather earn the fee by finding real, fixable problems than charge you to confirm you are fine.
Next steps
The sensible order is to run the free Surface Check first, clear anything visible from the outside, and then talk to us about the parts a passive check cannot reach. When you are ready, you can get in touch through our website and we will take it from there.