THE THIRD DOOR / DONE FOR YOU
A hands-on security audit of your AI-built app. I test it the way an attacker would and write up every hole with the exact fix. With Audit + Fix, I close the holes myself.
Apply for a slotTaking 2 Security Audits and 1 Audit + Fix a month.
Every application gets a reply within 2 business days.
You, or your AI tool, close them.
Everything in Security Audit, plus:
Prices in USD. Delivery counts from the day access works.
Not ready for this? The $19 kit covers the same 15 holes, and you do the work.
A two-minute form about your app. Nothing is charged.
Within 2 business days: yes, waitlist, or not a fit (with where to go instead).
By email: what's in scope, what's off-limits, and the dates. No calls.
A private payment link, a signed agreement and a GitHub invite. No passwords.
A written report that explains every finding. For Audit + Fix, pull requests and a retest too.
Tested by hand on your app, with two test accounts, on staging. Plus anything else I find on the way.
An audit pays off once real people trust your app with their data or money.
Before that, the $19 kit is the better deal.
HOUSE RULES
The agreement already covers confidentiality: your code, data and findings stay private, and I never publish anything about your app. If you have your own NDA, send it over with your application.
Apply anyway and describe it. Larger apps, several services or unusual stacks get a custom quote once I've seen the details.
Most AI-built web apps: Next.js, React, Vite and Node, with Supabase, Firebase, Postgres, Stripe, Clerk and similar. Built with Lovable, Bolt, Cursor, v0, Replit, Claude Code or by hand. Native mobile apps aren't covered yet.
Then you have it in writing. The report lists every check that passed as well as what failed. That's worth showing to customers, partners and your future self.
No. It's a hands-on security review aimed at the holes AI-built apps actually have. It's not a certified penetration test or a compliance audit, and no review can guarantee an app is secure.
No. Everything happens in writing: the scope, your questions and the report. Each finding is explained in plain language with the exact fix, so you don't need anyone to talk you through it. Questions are answered by email.
Full refund before work starts. A Security Audit can't be refunded once the report is delivered. If you cancel Audit + Fix after the audit stage, you keep the report and the second 50% isn't charged. See the audit terms.
It depends on open slots. I take 2 Security Audits and 1 Audit + Fix a month. If they're full, you go on the waitlist and get the next opening first.
Yes, and many people should. The kit has the checklist, scanner and fix prompts I use. If you'd rather hand it over, apply here.
2 AUDITS AND 1 AUDIT + FIX A MONTH.
Audits are a business service for app owners and companies, not consumers. Applying doesn't create an agreement or authorize any testing.
Nothing is tested until a services agreement is signed by someone with authority over the app. You confirm you own the app, or are authorized to have it tested, and that your hosting providers allow it. I never test anything you haven't listed in writing.
One app, one repository, one test environment, as agreed in writing before work starts. No load testing, denial of service, social engineering, or attacks on third-party services. Anything outside the scope needs a new quote.
Security Audit: $500, paid in full before work starts. Audit + Fix: $2,500, half before work starts and half on delivery of the final report. Payment links are sent privately to accepted applicants only.
A full refund before work starts. No refund for a Security Audit once the report is delivered. If you cancel Audit + Fix after the audit stage, you keep the report and the second half isn't charged. If I can't deliver, you're refunded for anything not delivered.
An audit is a point-in-time review of what's in scope, using the methods described here. It does not guarantee that an app is free of vulnerabilities. It isn't a certified penetration test or compliance audit, and it isn't legal advice.
My total liability is capped at the fees you paid for the audit, and excludes indirect losses, to the extent the law allows. You keep backups, review fixes before deploying them, and rotate any exposed keys.
Your code, data and findings stay confidential. I only access what testing needs, and I delete code and notes 30 days after delivery. A case study is only ever published with your written consent.
Applications are collected with Tally, and payments are processed by Gumroad or Stripe, each under its own privacy policy. I use your details only to review your application and run your audit, never for marketing. If we don't work together, your application is deleted within 6 months. To have it deleted sooner, message @stackdrawn.
Every audit has a signed services agreement. If it differs from this summary, the agreement applies. Last updated: 24 October 2026.