Models don't think about attackers. We do.
AI writes the happy path. We find the other paths and close them.
An app with real users coming, or already there. Auth you're not sure about. Keys you might have committed.
A patched app, a threat model, and a list ranked by what would actually hurt you.
What's actually included.
Dependency and secret scanning, including everything already in your git history.
A full review of how you handle auth, sessions, and passwords.
Testing for injection, XSS, CSRF, and broken access control.
Rate limiting and abuse controls on anything that costs you money.
Fixes applied, then re-tested to prove they hold.
What we work with.
What we test against and what we build with. Where a standard is named, it means we build to it and give you the evidence, not that we can certify you.
Fair things to ask.
Is this a penetration test?
It's a code-level review plus targeted testing. We read the source, which a black-box pentest can't. If you need a formal signed pentest for a client, we'll tell you and help you scope one.
Will you find everything?
Nobody can promise that. We prioritise what's exploitable and likely, and we're honest about what we didn't get to.
Do I get a report I can show clients?
Yes. Written for humans, with an executive summary at the front and the technical detail behind it.
What do you need access to?
The source, and an environment we can safely attack. Never your production database.
Will you test against production?
Not unless you ask and we agree a window first. Testing live systems is how you take one down.
What if you find something serious mid-review?
You hear that day, not in the final document. Critical findings don't wait for a report.
Do you fix what you find, or just report it?
Either. Some clients hand the report to their own team, which is fine. We'll answer their questions.
We already had a pentest. Why do this?
A black-box test can't read the source. Most of what goes wrong in AI-written code is plain in the code and invisible from outside.
Will hardening slow the app down?
Rate limiting and input validation cost microseconds. Nothing we add is something a user would feel.
Can you help with compliance paperwork?
We can give you the technical evidence: what was tested, what was found, what was fixed. We're not auditors and won't sign off as though we were.