FIELD NOTE — AUDIT PRACTICE

I find what your team
can’t see anymore.

An independent forensic review of your SaaS — security, stability, and 152-ФЗ compliance — done in two or four weeks. Latest audit: 9 P0 + 19 P1 found in 12 days, including a live JWT impersonation bypass.

Book an audit → Get the OWASP + 152-ФЗ checklist

10+ years building product at Ozon · Avito · Yandex

01 — SCOPE

What I audit.

Three layers. Each one matters separately. Together they tell you whether your SaaS can survive scale.

Security

OWASP Top 10, auth flows, multi-tenant isolation, IDOR, JWT, secrets, webhooks. Runtime exploitation against a staging or production endpoint, with your permission.

Stability

Production log forensics, database pool config, error budgets, idle-session timeouts, P0 fatal patterns. Why your server “just falls over” — found in the logs, not guessed.

152-ФЗ compliance

Data flow mapping, consent logs, DPA gaps with cloud vendors (Yandex Cloud OCR, OpenAI, etc.), Roskomnadzor readiness. Compliance as code, not paperwork.

02 — ENGAGE

Two audit tiers. One retainer.

Fixed price, fixed scope. No RFP, no procurement theatre. Pick a tier, sign, start within a week.

Express Audit

₽180 000

2 weeks · fixed

Code review + production log analysis + OWASP Top 10 sweep + 152-ФЗ status. Top P0/P1 findings with fix recommendations.

Best for: pre-PMF SaaS, 5–50 users

Full Audit

₽450 000

4 weeks · fixed

Express + runtime exploitation tests + live demos of every P0 + 152-ФЗ deep dive + cloud DPA review + full-team walkthrough session.

Best for: SaaS with paying users

Partnership Retainer

₽120 000 / mo

3-month minimum

Monthly audit sweep + every-PR review on security-sensitive changes + 152-ФЗ ongoing advisory + design+engineering supervision.

Best for: SaaS scaling its team

Not for: bug-bounty replacement · ФСТЭК certification (need licence) · marketing “security badge” engagements

03 — FIELD NOTE · ANONYMIZED

A recent audit, redacted.

From a 12-day engagement with a Russian document-management SaaS, May 2026. Names removed, findings preserved.

EXECUTIVE SUMMARY — ANONYMIZED

9 P0 · 19 P1 · 15 P2 · 1 P3
+ 18 positive findings

[CRITICAL] Full multi-tenant bypass via JWT impersonation. Any authenticated user can become ADMIN of any other company on the platform with 3 lines of JavaScript in the browser console. Verified end-to-end.

[CRITICAL] Webhook signature verification fails open in production. 60 fail-open warnings + 57 unauthenticated callbacks in the past 12 days of production logs.

[CRITICAL] PostgreSQL connection instability — 1320 FATAL `terminating connection due to idle-session timeout` errors in 12 days. 6.7% of all log lines. Root cause: Prisma connection pool not configured for keepalive against Timeweb Postgres.

— 6 more P0 findings, 19 P1 findings, full fix plan, and a Sprint 1 roadmap delivered in the final report. Client gave permission to share this summary, anonymized.

04 — CHECKLIST

Audit your own SaaS first.

A free 32-point checklist combining OWASP Top 10 and 152-ФЗ compliance. The questions I open with on every engagement. PDF, 6 pages.

No newsletter. No drip funnel. One email with the PDF, then I leave you alone.

05 — FAQ

Questions I get.

Do you need access to our production database?

Ideally read-only access, yes. If that’s a blocker, a sanitized SQL dump works for most checks. We sign an NDA either way and I run a local PII sanitizer (Anonymous) over any logs you send before they touch any cloud tool.

Will you exploit findings on production?

Only with explicit written permission and with you watching. Default mode is static + low-impact runtime probes. The JWT bypass demo from the example above was run on a staging copy first, then reproduced on production with the client’s engineering lead in the room.

What about the deliverable?

A markdown report with severity-tagged findings (P0 / P1 / P2 / P3), reproduction steps, fix recommendations, and a Sprint 1 roadmap. Plus a 60-minute walkthrough call with your team. No 80-page Word documents.

Do you have an ФСТЭК licence?

No — and that’s on purpose. If you need a licenced auditor for state contracts or Roskomnadzor inspection prep, talk to RTM Group, Бастион, or Digital Security. My engagement is technical + practical, not certificatory.

How fast can you start?

Currently accepting 1 project, May–July 2026. Typical lead time is 1–2 weeks from signature to kick-off. Express Audit fits a 2-week sprint, Full Audit a 4-week one.

06 — START

Ready to look?

One email. We talk for 30 minutes, I tell you which tier fits, you decide. No pitch deck.

my@addicted.design

I find what your teamcan’t see anymore.