A fixed-price, one-day check of the app, portal or automation you had built with AI tools. You get a written report, ranked by severity, with the fix for each problem.
Grouped by the question an owner actually asks. Each one is a specific weak spot that shows up in apps built quickly with AI tools, drawn from the OWASP Top 10 and from the method I run on my own software.
Can only the right people sign in, and stay signed in?
Can one customer, or a stranger, see what isn't theirs?
Can someone feed your app something that makes it do what they want?
Is anything private sitting where it shouldn't?
What happens when someone hammers it, or something goes wrong?
This is a one-day review against the 36-point list, with a fix for each finding. It is not a CREST-accredited penetration test. If the review says a full manual pen test is warranted, I quote that separately.
We agree what the app does, what it holds and where it runs. I confirm the fixed price in writing before I start.
I work through the 36 points. I read and test; I do not change or break anything, and I use a test copy where there is one.
Ranked by severity, with the fix for each problem. If you want me to make the fixes, that is scoped and priced separately.
It is the oldest trick there is. Someone types a line of database code into a box that should only take a name or a search term. If the app pastes that text straight into its own database command, the database obeys it, and the result can be anyone reading every customer's details or wiping the lot. Checking the box in the browser helps your users but does not stop an attacker, who simply skips the browser. The fix that works is on the server: what people type is passed to the database as plain data, never as part of the command. AI tools often write this correctly, but not every time, and one missed spot is enough. That is why every form and search box gets checked.
No. I read and test; I do not run anything destructive. Where there is a test copy I use that. If I want to try something on the live app I ask you first.
Read access to the code, a look at how the app is hosted and set up, and a test login for each type of user. I do not need your real passwords or your customers' data, and I keep what I see confidential.
No. It is a structured one-day review against 36 known weak spots, by someone who runs the same method on his own software, and it is not a CREST-accredited penetration test. It tells you what I found and what to fix. It does not certify your app as secure, and no check can promise that. If the review says a full manual pen test is warranted, I quote that separately.
The report gives you the fix for each item. If you want me to make them, I scope and price that separately before anything starts, the same as any build.
No. An AI tool, an agency or a freelancer: I check what is running, not who wrote it.
Book a free call and we will agree what is in scope. Prefer a message? The form on the booking page reaches me directly, and I reply within one business day.
