Security for fast-shipping SaaS
You shipped fast. Now make it safe.
Security, infrastructure and compliance for SaaS teams whose app is live, growing and was built at speed.
Most AI-built apps leak somewhere.
Open database rules, keys in the frontend, one customer reading another's data. It works fine until someone looks.
We find every weak point.
Manual testing by a named engineer, aimed at what breaks SaaS: auth, tenant isolation, APIs and cloud config.
Then we fix it in your code.
Fixes arrive as pull requests on a separate branch, explained line by line, with your key flows checked after.
And prove it to your customers.
A retest and a closure letter your auditor or enterprise buyer will accept.
Which situation are you in?
01 We launch in a few weeksFind the holes before your users do. 02 An enterprise customer wants a pentestA manual report their security team will accept. 03 We need SOC 2 or ISO 27001Audit-ready without drowning in templates. 04 Our infrastructure is held together with tapeSafe deploys, real backups, locked-down cloud. 05 We think we've been hackedFast triage, evidence and containment.
Built with AI and shipped in a weekend?
These are the ten problems we find most often in fast-shipped SaaS.
- 01Supabase tables with Row Level Security switched off
- 02Firebase rules still in test mode
- 03API keys sitting in the frontend bundle
- 04User A sees User B's data by changing an ID
- 05Admin endpoints protected only by a hidden button
- 06No rate limits on login, signup or AI endpoints
- 07Stripe webhooks that aren't signature-verified
- 08Every deploy goes straight to production
- 09Backups nobody has ever restored
- 10No logs, so no way to know what happened
Recognised two or more? Talk to us before your next customer does.
What we do
Find it, fix it, prove it.
Penetration Testing
Manual web app and API testing your enterprise buyers will accept.
App Security Review + Fix
For apps built with Cursor, Lovable or Bolt. We review, fix in your repo and retest.
SOC 2 & ISO 27001 Readiness
Implement controls once, map them to both frameworks, pass the audit.
Cloud & Infrastructure Security
Safe deploys, locked-down cloud, real backups and monitoring.
Incident Response
Think you've been hacked? Fast triage, evidence and containment.
How an engagement runs.
- Step 1
Scoping call
30 minutes, free. Your stack, your deadline and what is driving it.
- Step 2
Fixed quote in 48 hours
Clear scope, deliverables and timeline. No open-ended hourly.
- Step 3
We test and review
Manual work by a named engineer, never on production without written approval.
- Step 4
Report and fixes
Prioritised findings, and pull requests in your repo if you want them fixed.
- Step 5
Retest and closure letter
Proof of what is resolved, ready for your customers or auditor.
See exactly what you get.
- Executive summaryOverall risk and top findings in plain language.
- Scope and methodologyWhat was tested, how, and what was out of scope.
- Findings summaryCount by severity at a glance.
- Detailed findingsSeverity, affected endpoint, proof, reproduction steps, impact and fix.
- Retest resultsStatus of every finding after remediation.
- Closure letterOne page your auditor or customer can file.
Questions
Before you book.
Is this just an automated scan?
No. We use tools for coverage, but every engagement is led by manual testing. Scanner output on its own is not a pentest.
Will you break production?
No destructive testing on production without your written approval. We prefer staging and agree the rules before we start.
Can our customers or auditor use the report?
Yes. Reports include scope, methodology, severity ratings and a retest letter in the format auditors and enterprise security teams expect.
Do you only find problems or also fix them?
Both. We open pull requests against your repo and retest after.
Can you make us SOC 2 compliant or ISO 27001 certified?
We get you ready and support you through the audit. The SOC 2 report comes from a licensed CPA firm and the ISO certificate from an accredited body.
What do you need from us?
A scoping call, test accounts and a signed authorisation. We sign an NDA first.
Find out what's wrong before someone else does. Book a call
30 minutes, free. You leave knowing your biggest risks, even if you don't hire us.