Before you take payments
Webhook replay, entitlement drift, and tier gates decide whether revenue and access stay in sync.
Fixed scope · Critical and High verified by Kurt · three business days
Know what needs fixing
before customers depend on your app.
A scoped review of the workflows that turn working demos into expensive incidents: authentication, customer isolation, billing, secrets, validation, logging, tests, and rollback. You get evidence-linked findings and a prioritized fix plan your team or coding agent can use.
Founder launch price: the first 5 reviews are $49. Enter code FOUNDER49 at checkout.
✓ One repository ✓ Prioritized findings ✓ 30-minute findings call ✓ Fee credited to a sprint within 30 days
Works with your coding agent
A defined deliverable, not another scan.
Keep your agent and its review tools. The review adds a fixed scope, a named person accountable for the review who verifies every Critical and High finding, and a fix plan ranked by what would cost your business most.
- Scope you can see. Every control in the published checklist, with coverage showing what passed and what could not be verified.
- Validated findings. Every finding carries evidence and a failure scenario; Kurt personally verifies every Critical and High finding before it reaches the report.
- Someone to question. A 30-minute findings call to challenge severity and agree on fix order.
- Ready to execute. Remediation steps and verification tests you or your agent can work through.
When a review pays for itself
Before your first business customer
Security questionnaires ask how the app was reviewed. A dated report with scope, method, and findings gives you specifics to point to. It is not a certification.
Before you raise or sell
Technical diligence moves faster when the highest-cost risks are already found, ranked, and on a fix plan.
After a scare
A leaked key, an odd charge, or a customer seeing data that isn't theirs. Find out what else shares the root cause.
No users, no payments, no sensitive data yet? Keep shipping and start with the free production-readiness checklist.
What gets reviewed
The failure paths that carry real business cost.
This is a focused review of production controls, not a generic code-quality score.
Auth + sessions
Login, session lifecycle, authorization boundaries, logout, password reset, and privileged routes.
Tenant isolation
Every customer-scoped read and write checked for cross-tenant access paths.
Billing + webhooks
Stripe signatures, replay protection, entitlement changes, tier gates, and failure recovery.
Secrets + validation
Environment separation, exposed credentials, request validation, unsafe redirects, and API abuse controls.
Logging + errors
Useful production signals without leaking tokens, personal data, internals, or security-sensitive context.
Tests + rollback
Coverage of the highest-cost failure paths and a deployment rollback process that can actually be executed.
What you receive
A decision document, not a scanner dump.
Every finding explains the evidence, the practical failure mode, the recommended fix, and where it belongs in the launch sequence.
Open the sample report → production-risk-review.pdfCritical/High verified
executive_summaryFindings summary, Critical findings, and a suggested fix order
prioritized_findingsSeverity, evidence, exploit/failure scenario, and recommended remediation
control_coverageWhat was reviewed, what passed, and what could not be verified
remediation_planFix order, effort range, dependencies, and suggested verification tests
findings_call30 minutes with Kurt to challenge findings and decide next steps
How it works
Three days from access to prioritized answers.
- 01
Purchase + intake
Tell us what is launching, the stack, and the failure you are most worried about.
- 02
Bounded access
Grant time-bounded read-only repository access. You can revoke it at any time.
- 03
Review + report
Kurt verifies the Critical and High findings, ranks everything by business risk, and delivers the report within three business days.
- 04
Decide
Review the findings together. Fix them yourself, or apply your review fee as credit to a Hardening Sprint started within 30 days of delivery.
Engagement security
Your code stays yours. Every action stays accountable.
- Human accountability. Kurt is accountable for the review and personally verifies every Critical and High finding before delivery. AI tools assist; they don't sign.
- No autonomous production changes. AI systems cannot deploy into client production, and no client change ships without human approval.
- Bounded access. Access is time-bounded, least-privilege, and revocable. We do not ask for customer data when code and configuration evidence will do. AI providers process your repository on our behalf under their commercial terms.
- Client ownership. You retain ownership of source code, accounts, infrastructure, and every deliverable.
Common questions
Can't Claude Code, Cursor, or another coding agent do this?
Keep using them, including their automated review features. This is a different deliverable: a scoped pass over the published production-readiness checklist, with every Critical and High finding personally verified by Kurt before delivery, every finding backed by evidence and a failure scenario, ranked by business impact, and walked through on a 30-minute call where you can challenge it. The remediation plan is written so you or your coding agent can execute it. If your current review process already gives you that confidence for what's at stake, you may not need this.
Who is this not for?
If the app has no users, takes no payments, and holds no sensitive data, you probably don't need a paid review yet. Keep shipping and use the free production-readiness checklist. The review pays off when a mistake would cost money, customer trust, or a deal.
What do you need access to?
Read-only repository access is usually enough for the review. If deployment configuration lives outside the repository, you can share exported settings; controls we can't see are marked not verifiable rather than guessed. We never access your running systems, and we do not need production database contents, customer records, or credentials.
Do you use AI in the review?
Yes. Automated tools and AI models assist the review passes. Kurt personally verifies every Critical and High finding and recalibrates severity. The AI providers that process your repository do so on our behalf under their commercial terms; ask us which providers we use before you grant access.
Can I show the results to customers or investors?
Not yet as a signed letter. Signed Source Review Findings Letters become available once our professional liability cover is in place; ask before you buy if you need one. The report itself is for your internal use.
Do you change the application during the review?
No. The review is read-only. No code, infrastructure, billing setting, or production environment changes without a separate written scope and your explicit approval.
Is this a penetration test or certification?
No. It is a focused application production-risk review, not a penetration test, SOC 2 audit, compliance certification, or independent assurance engagement. Findings are based on the repository and context provided during the review window.
What happens if you find something critical?
We email you as soon as a Critical finding is confirmed instead of waiting for the final report. The report then documents the evidence, likely impact, and recommended remediation order.
Can you fix the findings?
Yes. A Hardening Sprint is scoped from the findings. The review fee you paid is credited in full toward a sprint started within 30 days of delivery.
What kinds of apps are a fit?
AI-built or AI-assisted web applications with something at stake: about to take payments, onboarding business customers, answering a security questionnaire, heading into diligence, or recovering from an incident. Lovable, Bolt, v0, Cursor, Claude Code, Replit, and conventional repositories are all welcome.
Not ready to purchase?
Reserve a review or ask about fit.
Share the basics. We reply within one business day and will tell you plainly if the fixed-scope review is not the right starting point.
Book 30 minutes with Kurt →