Paid security reviews

I break apps. Before someone else does.

I spend my free time taking apart other people’s apps and reporting what I find. A review is the same process, pointed at your app while it is still your call how it ends. Fixed prices, checkout in a minute, and you talk to the person doing the work.

Pricing

Most popular

Full review

$899per app

Your whole app: client, traffic, and backend. One price, everything included.

  • One app — iOS, Android, or web/SaaS
  • Traffic analysis and client teardown with my own tooling
  • API and backend endpoints in scope
  • Auth and authorization logic: IDOR, sessions, rate limits
  • Every finding manually verified — no raw scanner output
  • Report with reproduction steps, plus a 30-minute debrief call
  • One free re-test after you ship the fixes
  • Delivered within 10 working days
Book the review

Company

from $2,900custom scope

Multiple apps, a larger attack surface, or compliance needs.

  • Scope defined together in a call
  • Multiple apps and platforms
  • NDA and compliance paperwork covered
  • Report suitable for customers and auditors
  • Ongoing re-tests as fixes land
Book a scoping call

You must own the app or be authorized to have it tested. Scope is confirmed before any testing starts — if your app is out of scope for the tier, you get a full refund.

Track record

The same process, pointed at other people's apps.

Nothing in a review is invented for the occasion. It is the routine from my public research, and this is some of what that routine has turned up.

  1. Nusuk

    Government

    Ministry of Hajj and Umrah, Saudi Arabia · 10M+ installs

    Credentials for a banking channel shipped inside the release build. Reported through CERT/CC, rotated and confirmed by the ministry.

    Fixed

  2. Muslim Pro

    Quran and prayer-times app · iOS · Android · 100M+ installs

    Any community member’s name and birth date were reachable through a public user ID, along with the follower graph.

    Fixed

  3. Knowunity

    Learning platform for students · Android · 10M+ installs

    A production QA console, reachable by deep link, let any user grant themselves Premium and skip payment.

    Reported

  4. Caller ID and call-blocking app

    Name withheld · Android · 100M+ installs

    Five findings, two of them critical. Re-tested on the latest store build: still open.

    Under embargo

87
apps taken apart
44
disclosure write-ups
10
CVE requests
100M+
largest install base
See all findings

How it works

Three steps. Ten working days.

No kickoff deck, no discovery phase. You book, I confirm, you get a report.

  1. 01

    Book and share your app

    Pick a tier and drop your store page or URL at checkout, or grab a slot in my calendar if you need a custom scope. Not live yet? Leave it empty and we sort out access over email.

  2. 02

    I confirm scope within 24 hours

    A short sanity check that the tier fits your app. If it does not, you get a straight answer and a full refund.

  3. 03

    Report lands in your inbox

    Verified findings, reproduction steps, and fixes, within ten working days. Tell me when you have shipped them and I re-test for free.

Questions

Before you book.

Not sure which tier fits? Grab 30 minutes with me and I will tell you straight, including when the answer is that you do not need a review yet.

What if you find nothing?
You still get the full report: what was tested, how, and why it held up. A documented clean pass is worth having.
Do you need my source code?
No. I test black-box, the same way I approach my public research, and the same way an actual attacker would.
How does the indie price work?
Honor system. If you are building alone and paying out of your own pocket, flip the switch. I will not ask for proof. Same review, same report, same re-test.
Can we sign an NDA?
Happily. Findings from paid reviews are never published without your consent either way. That is part of my disclosure policy.

Same rules as my public research

The reviews run under the same constraints I hold to when nobody is paying: my own devices, my own accounts, one request to prove a boundary is broken, nothing destructive, secrets redacted. The one difference is publication. Findings from a paid review are yours, and nothing about them leaves my inbox without your consent.

Read how I test and my disclosure policy