What we cannot do
In more detail
We do not guarantee that an app is free of vulnerabilities
A test covers what the checklist for your package describes, on the version you gave us access to, on the date of testing. We find what those checks reach in the time the package includes. An issue outside the checklist, or introduced after the test, is not covered until a re-check.
Findings describe what we observed on the version you gave us access to, on the date of testing. Changes after that date are not covered until re-checked.
We are not a certified penetration-testing firm
A penetration test (A simulated attack by a certified tester, often required for compliance reports.) for compliance purposes follows a formal scope, rules of engagement and a certified methodology. Our packages are checklist-based tests written for the people who build with AI tools. They are useful before launch, before payments and before a first security conversation with an investor or buyer. They are not a substitute for a compliance attestation when a contract requires one.
We do not rebuild your app
Findings come with a fix direction: what to change, where, and how to confirm it worked. The fix itself is done by you, your developer or your AI tool. We re-check critical findings within the package window. Rebuilding parts of the app is a separate agreement.
We do not test what we cannot reach
Third-party services you use (payment processors, hosting providers, the AI builder itself) are outside our scope except for how your app is configured to use them. We report configuration findings; we do not test the provider.
We do not publish your results
Reports are confidential. We do not publish case studies, client names or results, which is why our credibility rests on the public failure catalogue, the synthetic sample report, the published checklists, fixed prices and the money-back term.
Questions about limits
does a security audit mean my app cannot be hacked
No. A test finds what the checklist and the tester's time can reach on the version tested, on that date. It reduces the number of known problems; it cannot prove the absence of unknown ones. We write that limit into every report.
do you provide soc 2 or pentest certification
No. We are not a certified penetration-testing firm and do not issue compliance attestations such as SOC 2, ISO 27001 or PCI reports. If a buyer requires one, our findings report can support the preparation, and we will say so plainly in the document.
will you fix the issues you find
Not as part of a testing package. Every finding comes with a fix direction your developer or your AI tool can apply, and we re-check the fixes. Rebuilding or rewriting parts of the app is a separate agreement, quoted on request.
Full terms: Terms of service. Questions: contact.