We ask people to check this one first, because it is common, it is silent, and the gap between shipping and finding out is where the damage happens. While it is true, nothing inside your application looks the least bit wrong.
Nothing, from where you are standing. No failed sign-in to notice, no error to chase, nothing slower than yesterday, because reading your records does not require breaking anything. Most people learn about it from somewhere else entirely: a researcher's email, an automated report from a scanner, or their own customer list turning up in a place they did not put it.
Everything a stranger needs is already on the page your site serves, because your own screens use it to work at all: an address to ask, and a token to ask with. From there, a few lines typed into a browser console request the contents of a table — not the pages you designed, but the rows beneath them, in bulk, in one go, with nobody signed in. That is the part people underestimate, and it is what makes this unlike a leaked password: a password belongs to one person and can be replaced by tea time, whereas here the address and the token were always meant to be readable, and what should have refused the request was never put there.
We list your tables against the rules each of them carries and mark every table holding anything about a person. Then, with your permission, we make the request an outsider would make: your public key, your address, no account, and we read back whatever comes. What you get is a table-by-table statement of what is reachable without signing in, which is the form of the answer you can act on.
Every table holding records that belong to somebody: rules enabled, then a policy written for each operation, saying which rows an account may read, insert, update and delete. The application changes too, because queries written while everything was permitted often ask for rows they were never entitled to, and a page doing that starts coming back empty the moment the rules land.
$199$349promo
You send a link, a repo, or both. We reproduce the problem, read the code, and record a short walkthrough: what's broken, why it broke, and what it takes to fix. You get written findings and a fixed quote.
Book my auditPriced after the audit
Scoped from the audit and agreed before anything starts. We fix the cause rather than the symptom, and hand back something maintainable, with a written note on what changed and why.
Nobody can price this honestly before seeing the code. The audit is what makes a firm number possible.
The audit is a fixed price and you know it before you pay. Everything after it is quoted from what the audit actually found, and you approve the number before any work starts.
What we can show you is who does the work, what it costs, and how well we already know the failure you are staring at.
This is run by a small web agency. The person who records your audit is the person who does the fix, so you're not being routed to an anonymous bidder.
$199$349promo
Plenty of people take the findings and do the work themselves, or hand them to their own developer. That is a fine outcome and nothing is bundled to stop it.
Book my auditYou approve a number before work starts. If the job turns out harder than we estimated, that's ours to absorb, not a change order.
Security is the part an AI builder is quietest about. None of these stop the app working, which is exactly why they ship.
If you recognised your own problem somewhere above, that is the point. The audit is where you find out which one it actually is.
$199$349promo
One fixed-price audit at $199 instead of $349. A video walkthrough, written findings and a firm quote on what it takes to fix.