Find the holes in your AI-generated code before someone else does.
AI coding tools are good at making things work. They are much less reliable at making things safe. The failure modes are consistent: API keys shipped to the browser, endpoints that check who you are but not what you are allowed to do, database rules left wide open so the demo works, no rate limits anywhere. None of this shows up in normal use. It shows up when someone goes looking.
An AI app security audit is us going looking first. We take read-only access to your repository and spend 5 working days on it: automated scanning for the known problems, then engineers reading the code, with the most time spent on authentication, authorisation, payments, and personal data. We use AI heavily in our own work, so we know the patterns these tools produce and where they cut corners.
You get a written report with every finding ranked by severity, the exact place in the code, and a concrete fix. Before any of that, we sign a mutual NDA, the same day, before you share anything. The price is fixed, in writing, within 48 hours of a scoping call, and it does not change after we start.
Founders who built an app with AI tools, have users or are about to, and know that nobody with security experience has read the code. The trigger is usually concrete: a first paying customer, an investor's due-diligence list, or a bigger client sending over a security questionnaire.
Established businesses fit just as well. A contractor or an internal team shipped an AI-assisted project, and you want a second pair of eyes before it touches customer records or payments. You do not need to have written a line of it yourself. A reader with no stake in the code is the point.
One honest limit: this is not a compliance certification. We will not hand you a SOC 2 badge. What you get is an engineering review: what is broken, how bad it is, and exactly how to fix it.
Scoped in writing. Delivered in your accounts.
Authentication and authorisation review
Every route and API endpoint checked for who can call it and what it lets them see or change.
Secrets and key handling
API keys in client bundles, credentials left in repo history, tokens in localStorage, service keys with more power than they need.
Data isolation checks
Row-level security, tenant separation, and whether one user can read another user's records by changing an ID in a URL.
Injection and input handling
SQL injection, unsafe file uploads, and prompt injection anywhere your app passes user text to a model.
Dependency and configuration scan
Known-vulnerable packages, debug flags left on, exposed admin routes, and permissive CORS settings.
Money and personal data paths
Anything that touches payments or personal data gets a line-by-line read by an engineer, not just a scanner.
Ranked written report
Each finding gets a severity, the exact file and line, and a fix you can hand to whoever writes the patch.
Report walkthrough call
We go through the report together, answer questions, and help you decide what to fix first.
Scoping call and NDA
A short call to understand the app and what worries you. The mutual NDA is signed the same day, before you share anything, and the fixed price follows in writing within 48 hours.
Access and automated pass
You grant read-only access to the repository. We run dependency, secret, and configuration scans to clear the known problems first.
Manual review
Engineers read the code, spending the most time on authentication, authorisation, payments, and personal data. Anything urgent is flagged the day we find it, before the report is written.
Report and walkthrough
You get the written report with ranked findings and concrete fixes, then a call to go through it. If you want us to do the fixing, that is a separate fixed-price quote.