Find out what's actually exposed
before someone else does.
Symbiotic Security's scan puts the numbers at 98% of 1,072 Supabase-backed vibe-coded apps carrying at least one security issue, 16% of them critical, and UpGuard Research separately found 16,326 Supabase databases returning readable tables to an unauthenticated probe. Finding out after a breach is the expensive way to learn this. We find out first, tell you straight, and hand you a scorecard you can act on.
The polish hides the missing fundamentals.
- You genuinely don't know whether Supabase or Postgres row-level security is turned on for every table, or you know it isn't.
- A Stripe, OpenAI, or Supabase key was pasted straight into the frontend because that's what got the demo working fastest.
- An API route returns data for any user ID you pass it, not just the one who's logged in.
- An investor, customer, or partner asked "how do you handle security" and the honest answer was a shrug.
- An AI coding agent has write access to your production database and nobody's fully sure what it's allowed to do with it.
Manual review plus real exploit attempts, not just a scanner report.
Recon & attack surface mapping
Enumerate every public endpoint, API route, and database table, and identify what's reachable with no authentication at all.
Auth & access control review
Test row-level security policies, JWT validation, and role boundaries with real exploit attempts, not just a read-through of the code.
Secrets & key audit
Scan client bundles, env files, and git history for hardcoded Stripe, OpenAI, Supabase, or cloud keys, then rotate anything exposed immediately.
Data exposure testing
Attempt to read, write, or delete another user's data through the live API to confirm access controls actually hold under pressure.
Dependency & infra scan
Check for known-vulnerable packages, exposed admin panels, and misconfigured storage buckets or file uploads.
Scorecard & roadmap
A prioritized, plain-English report ranking every finding critical to low, with the exact fix required for each one.
A report you can act on, or hand to someone else.
- A scored security report (0–100). Not a vague "looks fine," a number tied to specific findings.
- A prioritized findings list. Every issue ranked critical to low, in plain English, with the specific fix.
- Immediate patching of critical, actively-exploitable issues. We don't wait for the final report to rotate an exposed key.
- A remediation roadmap. What to fix, in what order, and roughly what it costs, before you commit to a bigger engagement.
- A re-test after fixes ship. Confirmation that what got closed actually stayed closed.
A fixed fee to know, a scoped price to fix.
Start with a $1,500 Rapid Diagnostic. The full audit itself is fixed-fee, and the Rapid Diagnostic fee is credited toward it. If you want us to remediate what we find, that's scoped after the report, so you're never guessing.
Security scorecard, findings list, and remediation roadmap. Pending scope, days not weeks. Preceded by a $1,500 Rapid Diagnostic, credited toward this fee.
If the audit finds real work to do, we close the critical holes and harden the app as a follow-on engagement.
See the full pricing breakdown for every service.
If any of this sounds like you.
Composite personas, written to describe who this is for. Not real clients, and not real messages.
"An investor wants to see the code, and I'm not sure what they'll find."
You raised on a great product that's mostly AI-generated. Get it assessed, with a written remediation plan in hand, before diligence starts.
"It works in the demo. I have no idea if it's actually safe."
You have real users on a foundation you don't fully understand. We tell you exactly what's open, without making you feel dumb about how you got here.
"We built it fast. We want a second opinion before it goes live."
A pre-launch audit from a senior team outside your build process, so nothing gets missed because everyone's too close to it.
Exactly what is in scope, and exactly what is not.
The same spec block sits on every service page, so you can compare them line for line. What is excluded matters as much as what is included, because that is where scope disputes come from.
- Attack surface mapping: every public endpoint, API route and database table enumerated, with whatever is reachable unauthenticated called out explicitly.
- Authentication and access control review, tested with real exploit attempts against your own endpoints rather than read off the code.
- Row-level security policy review on every table, including the tables nobody remembered were there.
- Secrets audit across client bundles, environment files and full git history, with immediate rotation of anything found exposed.
- Data exposure testing: attempts to read, write or delete another user's records through the live API.
- Dependency and infrastructure scan for known-vulnerable packages, exposed admin panels and misconfigured storage or upload handling.
- A scored report, 0 to 100, with every finding ranked critical to low and the exact fix stated for each one.
- A re-test after fixes ship, confirming that what got closed stayed closed.
- Remediation of everything found. Actively exploitable criticals get patched immediately where we can. The rest is scoped as a separate Rescue & Harden engagement.
- Any certification. We assess and harden. No engineering firm can issue a SOC 2 report, certify HIPAA compliance or produce a PCI attestation. See the note below this block.
- Social engineering or physical security assessment. This is an application and infrastructure review.
- Continuous monitoring after the report lands. That is the ongoing engineering retainer.
- Legal advice on breach notification obligations, or acting as your data protection officer.
- Rewriting your architecture. If the finding is that the design itself is wrong, we say so and scope it separately rather than quietly rebuilding it inside an audit fee.
A written security report with a 0 to 100 score, a prioritized findings list in plain English, a remediation roadmap with rough costs against each item, and evidence attached to every finding so a third party can verify it. Written so you can hand it to an investor, a customer's security team, or the next engineer, without translation.
3 to 5 business days from the point repository and infrastructure access is granted. Critical, actively exploitable findings are flagged and, where possible, patched the day we find them rather than held back for the final report.
Senior engineers only, with production experience that predates the current generation of AI tooling. The engineer who runs the audit is the engineer who writes the report and walks you through it. No junior pool, no offshore handoff, no account manager in between.
- Codebase size, and how many separate services, databases and providers are in play.
- Data sensitivity. Cardholder or health data raises the rigor required at every step, and raises the consequence tier the work is priced in.
- Timeline. Compressing an audit into 48 hours because a diligence call is on Friday costs more, not less.
- Whether a staging environment exists. Testing exploit attempts against production only is slower, more careful work.
- How much documentation exists. A cold read of an undocumented codebase takes longer than a guided one.
Send the repository and a short description of your infrastructure. We confirm the fee and the exact access list, start inside 24 to 48 hours, and deliver the scored report with a walkthrough. If you want the findings fixed, that is scoped and fixed-priced from the report you are already holding, so you are never approving work you have not seen justified.
We can assess a system against a named standard's technical requirements, harden it, remediate what fails, and produce documentation an auditor will test. We cannot certify compliance with any of them, and neither can any other engineering firm. A SOC 2 report is an attestation issued only by a licensed CPA firm. HIPAA compliance is the covered entity's own legal obligation, and no government-issued HIPAA certification exists. A PCI DSS attestation can only be issued by a certified Qualified Security Assessor. We prepare for those processes and we support your path through them.
What founders ask before an audit.
What's actually included in the audit?
A full review of authentication, row-level security policies, exposed secrets and API keys, unauthenticated endpoints, and dependency vulnerabilities, delivered as a scored report with a prioritized remediation roadmap.
How long does the audit take?
Most audits take 3 to 5 business days from the point we get repository and infrastructure access. Critical, actively-exploitable findings get flagged and, where possible, patched immediately rather than waiting for the final report.
Do you fix what you find, or just report it?
Both are available. The diagnostic audit itself is a fixed-fee report. If you want us to remediate the findings, that rolls into a Rescue & Harden engagement, scoped and priced after we know exactly what's wrong.
Is this a penetration test?
It overlaps with one. We combine manual code review of auth and access-control logic with targeted exploit attempts against your own endpoints and database policies, which catches failures automated scanners typically miss, like disabled row-level security.
What if the audit doesn't find anything critical?
That happens, and it's still valuable. You get a documented scorecard you can hand to an investor, a customer, or your own team, showing the app was actually checked rather than assumed safe.
What access do you need?
Read access to your repository and a description of your infrastructure (hosting, database, auth provider). We don't need production write access to complete the audit itself.
Send us the repo. We'll tell you what's actually exposed.
A senior engineer reads your actual code and gives you a straight assessment. No sales engineer, no junior.