Full audit
Start hereFor teams and startups who need a document, not just a list.
$1,900
Report in 5 business days
- All catalogue categories
- Repository and live app
- Investor-ready summary document
- Prioritised fix roadmap
- One-hour walkthrough call
Before an investor or security review
A term sheet is close, or an enterprise buyer sent a vendor questionnaire. Someone has asked for a security summary and there is nothing to send. You do not need a certificate; you need a document that says what was tested, what was found, what was fixed, and what remains, on a date, by someone who is not you.
Written for startups before an investor or security review.
What to check first, in this order
Ordered by what a stranger reaches first. Each links to a self-check you can do today and to what our test adds.
- 01CriticalSecrets committed to the code repository
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
- 02CriticalRow Level Security disabled on a table
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
- 03CriticalAuthorization enforced only in the browser
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
- 04CriticalTokens trusted without server verification
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
- 05HighDependencies with known vulnerabilities
A published advisory is a public instruction sheet, so an attacker does not need to find a flaw in your code; they only need to know which library version you run.
- 06MediumNo automated checks before deploy
Type errors, broken imports and failing behaviour are discovered by users after deploy rather than by a machine before it, and each fix is another untested push.
- 07HighNo backup that has ever been restored
When data is deleted or corrupted, whether by a bug, an agent or a person, there is either nothing to restore or a backup nobody has proven they can actually bring back.
- 08MediumMissing security headers
Without these headers a browser will happily load the app inside someone else's page, over plain HTTP, or with injected scripts, which turns an otherwise small bug into a working attack.
- 09MediumDebug mode left on in production
Anyone who causes an error sees file paths, query text and sometimes environment values, and dev-only shortcuts such as skipped checks or seeded test users stay active for real visitors.
What happens without checking
Research on AI-assisted development found more security findings in code from teams using assistants than from their peers, including privilege escalation paths and design flaws (Apiiro, 2025). A reviewer who knows that will ask how you test. The answer that works is a scope, a method, a findings list with fixes, and a date. The full audit produces exactly that document.
Apiiro's analysis of repositories at Fortune 50 companies found AI-assisted developers produced 3 to 4 times more commits and 10 times more security findings, with privilege escalation paths up 322%.
- 3 to 4x Commits by AI-assisted developers vs peers
- 10x Security findings by AI-assisted teams
- more than 10,000 New AI-introduced findings per month by June 2025
- +322% Privilege escalation paths
- +153% Architectural design flaws
Sep 2025 · Apiiro · all sources
CodeRabbit reviewed 470 open-source GitHub pull requests (320 AI co-authored, 150 human-only) and found AI co-authored pull requests contained about 1.7 times more issues overall and up to 2.74 times more security issues.
- 470 Pull requests analysed
- 320 AI co-authored PRs
- 150 Human-only PRs
- about 1.7x Issues overall vs human-only
- up to 2.74x Security issues vs human-only
Dec 2025 · CodeRabbit · all sources
Which package
Pre-launch check
For founders about to let real users in.
$490
Report in 48 hours
- Keys and secrets in the browser or repo
- Who can read and change whose data
- Login, roles and admin routes
- Errors, retries and rate limits
- Debug mode, headers, deploy path
Compare all packages, or run the self-check first.
Questions
what security documentation do investors ask for
Usually a summary of how you handle data, authentication and secrets, whether you test, and any known issues. Rarely a certificate at seed or Series A. The full audit's summary document is written for this reader and says plainly that it is a test report, not an attestation.
do i need a soc two report for due diligence
Most early-stage investors do not require it. Enterprise buyers sometimes do, and that is a separate, longer process. A findings report shows you take the question seriously and gives a compliance consultant a head start later.
how long does a full code audit take
Five business days from access to report, plus a one-hour walkthrough. The re-check window is 30 days, so you can fix before the review and show the re-tested result.
Other moments: before you launch, before you take payments, before a client handover, after something went wrong, you received a security email.