Is this a penetration test?

It is primarily a code and configuration review: we read the source rather than attack a live system from outside. That finds issues a black-box test misses, and costs less.

At a fixed price, based on the size of the codebase and what is in scope. You get the price before we start.

Will you share our code or findings?

No. Access and findings stay between us and you, and we can sign an NDA before we start.

Do you audit smart contracts?

Yes, for EVM chains and Solana. For contracts that will hold significant funds, we recommend an additional audit by a second, independent team.

Code and Security Audit

What we check

Authentication and access control — sign-in, sessions, roles, and whether one user can see another user’s data.
Input handling — injection, unsafe file uploads, server-side request forgery and similar classics.
Secrets and configuration — keys in the repository, over-privileged accounts, debug settings left on in production.
Dependencies — outdated and vulnerable packages, and how hard they will be to upgrade.
Payments and money logic — rounding, currencies, webhooks, and what happens when a request is sent twice.
Code health — test coverage of critical flows, deployment, error handling, and parts nobody dares to touch.
Smart contracts — access control, reentrancy, arithmetic, upgradeability and admin keys on EVM chains and Solana.

How it works

1. Access and context

You give us read access to the code and, if relevant, the infrastructure. We ask what the system does, what data it holds and what worries you.

2. Review

We read the code by hand, supported by automated scanners, and follow the flows that matter most: money, personal data and admin actions.

3. Report

You get a written report: each finding with its severity, where it is, why it matters and how to fix it — ordered so the most dangerous issues come first.

4. Fix, if you want

Your team can fix the findings, or we can do it and add tests so they stay fixed. A short re-check confirms the result.

Good fit if you…

are about to launch, raise money or sign a larger customer who will ask about security;
inherited a codebase and want to know what you are dealing with;
are deploying a smart contract that will hold other people’s funds.

Code and security audit