Limited pilot offer
I'm offering a limited number of free, manual security reviews for small SaaS products and web applications. You'll receive a practical report explaining any verified vulnerabilities, their potential impact, how to reproduce them, and how to fix them.
Automated tooling is used for efficiency, however everything is manually verified.
This pilot is designed for independent developers and small teams building an early-stage SaaS product, recently launched web application, portfolio application, or internal tool with a safe testing environment.
It is not intended for large enterprise systems, critical infrastructure, compliance certification, or applications that cannot be tested safely. I may decline applications whose size, sensitivity, or risk exceeds the pilot’s scope.
The exact test plan depends on the application’s functionality and the scope agreed before testing begins.
Each accepted review is limited to:
The following are not included:
My background combines two years of web development with real-world penetration testing and bug bounty. My published write-ups demonstrate how I identify, reproduce, and explain vulnerabilities rather than simply reporting scanner output.
Tell me about your application, its important workflows, and the environment available for testing.
I review the application for fit. If accepted, we confirm the testing boundaries, access, timing, and written authorization before testing begins.
I manually assess the agreed workflows and verify potential findings. If I confirm a critical issue, I contact you immediately.
You receive the PDF report and can ask follow-up questions about the findings and recommendations.
Most accepted reviews are completed within 7–10 business days after scope and access are confirmed.
This is a limited pilot while I refine my assessment and reporting process and build a portfolio of client work. There is no charge. After the review, I may ask for private feedback or permission to use a testimonial, but neither is required.
My background combines two years of web development with real-world penetration testing. My published write-ups show how I identify, reproduce, and explain vulnerabilities.
You receive a clear security report with any findings, severity ratings, reproduction steps, potential impact, and suggested fixes.
No. This is a focused manual web security review. It is not a full enterprise penetration test, compliance audit, or source code review.
This is a limited pilot while I refine my assessment and reporting process and build a portfolio of client work. There is no charge. Afterward, I may ask for private feedback or permission to use a testimonial, but neither is required.
No security assessment can guarantee that every issue will be discovered. The goal is to identify vulnerabilities that can reasonably be found within the agreed scope.
Not always. I can usually create a test account. If important functionality is behind a paywall or available only to another user role, I may request a dedicated test account with sufficient permissions.
The review focuses on finding and explaining issues. Implementation is not included, but the report provides practical remediation guidance.
I will contact you as soon as I verify it rather than waiting for the final report.
No. I will not publish details about your application or its findings without your explicit permission.