Before you charge real customers, I review the parts of your app that are most expensive to discover through an incident. This is a fixed-scope engineering review—not a SOC 2 audit or a generic checklist.

I review one app, repository, and deployment environment across: • Authentication, authorization, and tenant isolation • Payments, webhook verification, and sensitive actions • API routes, secrets, validation, and rate limits • Data safety, migrations, backups, and recovery • Deployment, monitoring, error handling, and rollback • LLM prompt injection and PII risks where relevant

You receive: • A prioritized written report: blocker, high, medium, and low • Evidence for each finding and a specific fix path • A launch / do-not-launch recommendation • A 30-minute debrief to walk through the report

Implementation is not included. If you want me to fix the findings, I’ll quote a separate fixed-price sprint. Delivered within 3 business days after access is ready.