Security reviews
Find the gaps before an automated attack does
Attackers now use automation and AI to scan the whole internet for the same handful of mistakes: an open database, a key left in the code, a package that shouldn't be trusted, an integration with far more access than it needs. Big companies and two-person startups get caught by the same things. We review your code, cloud setup, integrations and AI features for exactly those, and tell you plainly what to fix first.
What we review
- Logins, sessions and who can see or change which records
- Database rules, including Supabase row-level security and Firebase rules
- Keys, tokens and secrets in code, history, builds and logs
- Third-party packages, lockfiles and the build pipeline
- Cloud and hosting accounts: access, exposure, backups and logging
- Integrations and connected apps, and what each one is allowed to do
- AI features and agents: what they can read, and what they can do
What a review isn't
- A certified penetration test
- A SOC 2, ISO 27001 or IRAP audit or certification
- Around-the-clock monitoring or incident response
- Laptops, office networks and staff devices
Where you need one of these, we'll say so, and work alongside the specialist you choose.
How a review runs
01
Scope
A short call about what you run and what worries you. You get a fixed price and a written scope before anything starts.
02
Review
A senior developer reads the code and configuration with read-only access you grant, and checks the running system as an outsider would see it.
03
Report
Findings in plain English, ranked by risk, with the evidence and a recommended fix for each. Yours to keep and share with anyone.
04
Fix, if you want us to
Fixes are quoted separately at a fixed price. Your own team, or another provider, can work from the report instead.
What it costs. A single small app can start with our $495 fixed-price audit, with a written report in 3 business days. Larger codebases, cloud accounts and integrations are scoped on a call and quoted at a fixed price before any work starts.
Straight answers on security
The review
Code and Infrastructure Security Review
What a code and infrastructure security review checks, how it runs, what you get, and what it costs.
The threat
How AI Is Changing Cyber Attacks on Business
What's real about AI-driven cyber attacks, what the Australian figures say, and the defences that still work.
AI-built software
Is AI-Generated Code Secure?
Whether code written by Cursor, Claude Code, Copilot or an app builder is safe to ship, and what to check first.
AI agents
Securing AI Agents, Chatbots and MCP Tools
Prompt injection, over-permissioned agents and risky MCP tools: what can go wrong and how to limit it.
Supply chain
npm, PyPI and Software Supply Chain Attacks
How malicious npm and PyPI packages reach your app, what Shai-Hulud showed, and how to protect your build.
Secrets
Leaked API Keys: How to Check and What to Do
How API keys and secrets leak, how to check whether yours have, and exactly what to do if they did.
Integrations
Securing Integrations and Connected Apps
Why connected apps and OAuth tokens are a growing way in, and how to keep integrations from holding too much access.
Cloud and hosting
Cloud and Hosting Security: What to Check
The cloud, hosting and database settings that cause most exposures, and how to check AWS, Vercel, Supabase and Firebase.
Choosing
Security Review vs Penetration Test
The difference between a security review, a vulnerability scan and a penetration test, and which one you need.
Startups and scaleups
Answering Customer Security Questionnaires
How startups and scaleups answer enterprise security questionnaires honestly, and get ready for SOC 2 or ISO 27001.
After an incident
Think You've Been Hacked? What to Do First
The first steps if your app, website or accounts have been compromised, who to call in Australia, and what comes after.
- Already broken, stalled or inherited? Fix & rescue
- Raising, buying or selling? Technical due diligence
- The wider picture: the systems your business runs on
A review lowers risk; no review can promise a system won't be breached. If you think you're being attacked right now, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) first, then talk to us about the clean-up.
Tell us what you'd like checked
Describe what you run and what's worrying you. We'll suggest a sensible scope and a fixed price, or tell you plainly if a different kind of specialist would serve you better.