Each tier goes one level deeper and needs one more level of access. Reach out for current pricing — we'll point you to the right fit.
T1
The 10-Foot Audit
"Is it broken?"
2–3 days
- Click through every core flow and confirm things land where they should
- Break-test forms and inputs with junk, empty, and oversized values
- Watch the network tab for obvious leaks and client-side price/logic
- Mobile + desktop, plus error and broken-state handling
- Written findings report + 15-minute walkthrough call
Needs: access to the working app.
T2
The Pen Test
"Can someone break in?"
3–5 days
Everything in T1, plus:
- Auth testing — can we reach another user's data, ride, or account?
- Hunt for exposed API keys, service credentials, and database access
- Broken access control / IDOR — change an ID, see someone else's data
- Endpoint probing and business-logic abuse (e.g. tampering with a fare)
- Severity-ranked vulnerability report + walkthrough call
Needs: app + test account + written go-ahead, staging only, no real user data.
T3
The Code Review
"Is it built right?"
5–7 days
Everything in T1 + T2, plus:
- Read the code — auth logic, database rules, and permission model
- Secrets handling — hardcoded or committed to the repo?
- Architecture + data model, and where PII and location history live
- Dependency, config, and payment-flow review
- Full written audit with file/line references and specific fixes
Needs: read-only repo access. The deepest look — catches what the outside can't see.
T4
The Fix
"Make it right."
1–3 weeks
Stop auditing, start fixing:
- Hands-on remediation of the findings from T1–T3
- Production hardening — secrets, auth, and access control
- Re-test after fixing to confirm each hole is actually closed
- Two-week support window + a "here's what we changed" summary
Needs: repo access + agreed scope.
Most founders test on production, with real users. These fix that — and the recurring lines are where safe-shipping actually lives.
S0
Get-Set-Up
"Give me a safe place to test."
2–4 days
- A real staging environment, separate from production
- Realistic seed data that isn't your live users
- Secrets pulled out of the client and split from the code
- A one-page "how you ship from now on" checklist + 30-min walkthrough
Note: credited toward any audit or the Full Once-Over.
S1
Shipping Safety
"Keep me safe every time I ship."
ongoing
- Keep staging in sync with production
- Refresh seed data so tests stay realistic
- Monthly smoke test across the core flows
- We're your "I think I broke something" people before you push
Note: reliability upkeep, on a monthly basis.
S2
Show-Me Session
"Just show me how."
1 call
- One call — turn on the preview/branch environment you likely already have
- Set the safe-to-ship workflow and never-test-on-prod habit
- A Loom recording so you can do it yourself next time
- No ongoing commitment (but it warms you up for Shipping Safety)
Note: cheapest door in. Great for the ones not ready to commit.
New · recurring
SW
The Standing Watch
"Stay secure as you ship."
ongoing
- Every month, we review what you shipped — new features, endpoints, and flows
- Dependency + exposed-secret monitoring, flagged the moment they surface
- A short written report each month + a walkthrough call
- Priority "is this safe to ship?" answers between reviews
Note: picks up where a one-time audit ends. Best paired with any tier.