Consulting
Find out what you actually shipped.
Building an application has never been faster. Knowing whether it is safe to put real users and real data on it has not moved at all. That second question is the one we answer — in writing, against named standards, by someone who has run this kind of software in production for years.
Engagements
Four shapes
Security and enterprise-readiness review
You shipped fast. This tells you what you shipped. A read of the codebase against the OWASP Top 10 and the twelve-factor methodology, with a written finding for each item — what holds, what does not, and what closing it would take. The deliverable is a document you can put in front of a customer, an investor, or a security questionnaire, signed by someone who has run this software in production.
$3,500 fixed · one application
Performance and scaling review
What your application actually does under load, measured rather than guessed. We profile the running system, find where the time and the memory go, and hand back capacity numbers you can plan against: what the current shape holds, what breaks first when it stops holding, and what the fix is worth in headroom. Needs an environment we can profile against something resembling real load — we will tell you what that takes before you commit.
$4,500 fixed · one application
Work on what you have
Adding to a running application rather than replacing it — and à la carte, one block at a time. Multi-tenancy, field-level encryption with a KMS seam, MFA and email verification, rate limiting, an audit trail, tracing that survives async boundaries, or a performance pass with the numbers to show for it. The full block list is on the build page; take as much or as little of it as the review says you need.
$4,000 first block · $2,500 each after · $6,000 minimum
Build it
New software, end to end. If it is a Spring Boot application that needs the usual foundation underneath it, start with Kismet Blocks instead — it is the same work, already done, at a fraction of the time.
$12,000–$24,000 fixed before we begin
Commission block work within 30 days of your report and the first-block premium comes off — the first block is charged at $2,500.
The deliverable
What a review actually contains
Not a scanner dump with a severity colour next to it. Every finding is written by hand, tied to your code, and argued.
For each finding:
- The exact file and code path — not a category, the line.
- The attacker and the entry point — who does this, and from where.
- The asset or trust boundary at risk, so you can judge what it is worth to you rather than taking a severity label on faith.
- Safe reproduction conditions — how to see it yourself, without a live exploit against your own system.
- Counterevidence and a confidence level. Where something argues against the finding, it is written down. Uncertainty and probable false positives are labelled as such rather than padding the count.
- The smallest safe fix, and a regression test that keeps it fixed.
And for the report as a whole:
- A one-page trust-boundary map of the system.
- The areas reviewed where nothing was found. A review that only lists problems tells you nothing about coverage — and coverage is what you are actually buying.
- The three highest-value recommendations, ranked by what they are worth rather than by severity.
Generic best-practice checklists without code-specific evidence do not count as findings. If a tool could have produced it, it does not need a person.
How it works
Fixed scope where scope can be fixed
Most of this work can be quoted at a fixed price, because most of it can be scoped before it starts — a review is bounded by the codebase, and a defined addition is bounded by its interface. Where scope genuinely cannot be fixed, we say so and work by the day rather than pretending otherwise.
Everything is remote. Engagements are invoiced directly; there is no portal to sign up for and no subscription attached to any of this.
The first step is a conversation about what you have and what is going wrong with it. If we are not the right people for it, that is a faster answer than a proposal.