01
Secrets & credentials
Client bundles, repos, commit history, and configs, swept for anything an attacker could pick up off the floor: the classic vibe-code leak.
AI-Built Product Security & Rescue Audit
Your AI-built product shipped fast. Now make it safe.
A fixed-price, two-week security audit and architecture review for products built with AI: vibe-coded apps, Cursor and Claude Code projects, AI-accelerated builds. AI does the exhaustive sweep, a senior engineer verifies and signs every finding, and you get a written report with a fix roadmap your team can start on the same day.
$4,500 to $7,500, fixed on the first callTwo weeks, start to reportA senior engineer signs every finding
45%
of code from 100+ AI models failed security tests in Veracode's 2025 study
35
CVEs traced to AI-written code in March 2026 alone, up from 6 in January (Georgia Tech Vibe Security Radar)
1.5M
API keys exposed by Moltbook, a vibe-coded app, three days after launch (Wiz)
When founders call us
Speed got you to market. The code still hasn't been read.
You shipped with Cursor, Claude, or Copilot, and nobody has read the code
The product works, users are in it, and no senior engineer has ever read what the AI wrote.
You don't know where your secrets live
API keys in the client bundle, credentials in the repo history, tokens in a config file. The most common AI-code failure, and the most public one.
A customer, investor, or insurer just asked about security
A due-diligence list or a security questionnaire landed, and there's no audit, no report, and no one who can answer with a straight face.
You're building the company on code you don't fully trust
Every new feature stacks onto foundations nobody has inspected. The cost of looking never gets smaller.
What we check
Everything the AI wrote, and everything it forgot.
Six passes over your product, from the code itself to the cloud it runs on.
02
Authentication & access control
Auth flows, session handling, and authorization boundaries: who can see what, and what an attacker can reach by just changing an ID.
03
AI-specific risks
Prompt injection paths, model endpoints open to abuse and runaway spend, and customer data quietly flowing to third-party AI providers.
04
Dependencies & supply chain
Every package checked against known CVEs, including the abandoned and hallucinated dependencies AI assistants love to import.
05
Cloud & infrastructure config
Storage buckets, CORS, security headers, TLS, and infrastructure-as-code, reviewed for the misconfigurations that put companies in headlines.
06
Architecture review
Data flows, tenancy boundaries, and scaling hazards: whether the shape of the system can carry the business you're building on it.
How it works
Two weeks. Sweep, verify, roadmap.
AI gives the audit reach. Human judgment gives it value. You get both, on a fixed clock.
01
Sweep
Days 1 to 5. With read-only access, we run a full AI-assisted pass over your code, dependencies, configuration, and public surface. Every file gets read, most of them for the first time since they were generated.
02
Verify
Days 6 to 9. A senior engineer takes everything the sweep surfaced, kills the false positives, and rates what's real by severity and exploitability. Nothing reaches the report until a human has reproduced it.
03
Roadmap
Days 10 to 14. You get a written report with an executive summary you can hand to investors, plus a prioritized fix roadmap: what to fix now, what to fix soon, what to consciously accept. We walk you through all of it on a call.
Engineers who can secure what they build
We've worked in security since 2016 and run production AI since 2017.
We're not a scanner with a landing page. Federico De Faveri, the engineer who signs every report, has been fractional CTO of a New York promotions agency since 2017: he built and still runs Receipt Rewards, the OCR receipt-validation platform behind national promotions for Unilever, Knorr, Hellmann's, Scotch, Fandango, and Novamex. 100,000 receipts processed to date, 3 to 6 national campaigns a year, and the 2 a.m. emergencies the client never has to think about.
And the problems this audit hunts are not hypothetical. In one recent week of passive, public-surface reviews of five freshly launched AI-built products: one exposed its database configuration in the client bundle, three could have their email domain spoofed by anyone, and three shipped with no defense against clickjacking. Nobody had looked. That's the whole problem.
2016
In security work since
2017
Running production AI since
~100k
Receipts processed on our platform
Every
Finding signed by a named engineer
“Always available, endlessly patient in explaining every decision, calm in every emergency, and the quality of the platform has never let us down.”
Michael Eliran, CEO of Gamma Communications, New York
Pricing and scope
One fixed price. An honest scope.
Here is what the audit costs and where it ends. Every engagement is shaped around your product, your stack, and your stage, never a template; the range is what it is. Classic pentests run $10,000 to $30,000 and hand you a vulnerability list. This costs a fraction of that, and it answers the question a vulnerability list can't: whether the foundations are worth building on.
The audit
$4,500-7,500
Quoted on the first call, agreed before we start. It never moves.
- Two weeks, start to report
- Begins with read-only access
- Shaped around your product, never a template
- Never more than three audits at a time, so nothing gets skimmed
In the engagement
- Complete sweep of code, dependencies, configuration, and public surface
- Every finding reproduced and triaged by hand
- Written report with a summary built for your board and your buyers
- Prioritized fix roadmap, ordered by real risk
- Walkthrough call with the engineer who did the work
- One retest of the fixed criticals, within 30 days of the report
Not in it, on purpose
- ×SOC 2 or compliance preparation
- ×A formal attestation penetration test
- ×Continuous monitoring or managed security
Need one of those instead? We'll say so up front and point you toward the right kind of firm.
AI does the volume. A human signs the report.Nothing intrusive ever runs without written authorization.
The report is written for your own team to execute; the roadmap never assumes you'll hire us again. But if you'd rather have it handled, the audit rolls straight into our fractional CTO engagement: we fix what we found, then stay on to run your technology.
FAQ
Frequently asked questions.
Anything shipped with heavy AI assistance: built with Cursor, Claude Code, Copilot, or Bolt, vibe-coded from prompts, built by an agency leaning hard on AI tooling, or an existing codebase that grew fast with AI in the loop. If most of the code was written faster than it was read, this audit is for you.
It stays under our control. The review runs on our machines, and AI assistance goes through enterprise API agreements that do not train on your code. Access is read-only and revoked when the engagement ends, we retain nothing but the report we wrote for you, and we'll sign your NDA before seeing anything.
A fixed fee between $4,500 and $7,500, set on the first call based on the size of your codebase and surface area. There is no hourly meter: the number is agreed before any work starts and doesn't change mid-engagement.
No. AI gives us coverage: every file, every dependency, every config gets read. But raw AI security output is notoriously noisy, so a senior engineer who has done security work since 2016 reproduces, triages, and signs every finding in the report. You never see an unverified model dump.
The audit is primarily code, configuration, and architecture review under read-only access. Any active testing against running systems happens only under the signed engagement, with your written sign-off naming what will be tested.
No. Attestation pentests and SOC 2 audits exist to satisfy a compliance requirement; this audit exists to find and fix what's wrong. Doing it first means you walk into compliance work with a clean codebase. If a compliance artifact is what you really need, we'll tell you on the first call.
Then the report says so, plainly. You get the same deliverable: what we checked, what held up, and the short list worth tightening anyway. A clean report is a fine outcome, and a useful one to show investors and customers. We don't inflate severity to justify a fee.
The audit is the front door, and for most teams the fixed two-week engagement is enough. When founders want an AI security consultant on call, someone who reviews what the tools ship before it reaches production, that continues as our fractional CTO retainer: same engineer, ongoing cadence, security owned rather than sampled.
You get a prioritized roadmap your team can execute on its own. If you'd rather have us fix it and run it, that's our fractional CTO engagement: we remediate the findings and take ongoing ownership of your technology.
Two weeks from now
Find out what your AI shipped, before someone else does.
Bring your product to a free 30-minute call. We'll tell you straight whether the audit is worth it for your stage, and put a fixed number on it if it is.
Book a Free 30-Min Call→