Agree the scope
We agree which products, repositories, environments and integrations to check, then combine manual investigation with automated tools. Active checks run only within the agreed scope and permissions.
FIELD NOTE — AUDIT PRACTICE
Independent security & stability audit
Independent security & stability audit
for pre-PMF SaaS.
An independent forensic review of your SaaS — security, stability, and 152-ФЗ compliance — done in two or four weeks. Latest audit: 9 P0 + 19 P1 found in 12 days, including a live JWT impersonation bypass.
SCOPE
What we audit.
Three layers. Each one matters separately. Together they tell you whether your SaaS can survive scale.
Security
OWASP Top 10, auth flows, multi-tenant isolation, IDOR, JWT, secrets, webhooks. Runtime exploitation against a staging or production endpoint, with your permission.
Stability
Production log forensics, database pool config, error budgets, idle-session timeouts, P0 fatal patterns. Why your server “just falls over” — found in the logs, not guessed.
152-ФЗ compliance
Data flow mapping, consent logs, and DPA gaps with cloud vendors. A technical review of personal-data risks, not a legal opinion on full compliance.
How we audit
Check resilience
We inspect backups and restoration, migrations and rollback, observability and points of failure. Load testing and round-the-clock on-call support are separate scopes unless explicitly included.
Deliver evidence and a plan
You receive a risk register with reproducible evidence, P0–P3 priorities and a remediation plan. Express audit includes one re-test of fixed P0 and P1 findings within 60 days; full audit includes one re-test of all fixed findings within 90 days. Re-tests cover earlier findings only.
Limit access and protect data
We work under NDA with temporary, least-privilege access and sanitized logs. After the engagement, we remove working materials and ask you to revoke access; your report remains with you.
ENGAGE
Two audit tiers. One re-check.
Fixed price, fixed scope. No RFP, no procurement theatre. Pick a tier, sign, start within a week.
Express audit
$2,500
2 weeks
Code review + production log analysis + OWASP Top 10 sweep + 152-ФЗ status. Top P0/P1 findings with fix recommendations.
Best for: pre-PMF SaaS, 5–50 usersIncludes one re-test of fixed P0/P1 findings within 60 days of the report.
Choose this audit
Full audit
$6,000
4 weeks
Express + runtime exploitation tests + live demos of every P0 + 152-ФЗ deep dive + cloud DPA review + full-team walkthrough session.
Best for: SaaS with paying usersIncludes one re-test of all fixed findings within 90 days of the report.
Choose this audit
Re-check
$1,500
1 week
Verify fixes to findings from your earlier audit. Each finding is marked open, fixed, or re-verified.
before a major release or quarterlyChecks earlier findings only. A fresh search for vulnerabilities is a new audit.
Choose this auditPrices in USD. Invoiced from Georgia; no VAT added.
Not for: bug-bounty replacement · ФСТЭК certification (need licence) · marketing “security badge” engagements
FIELD NOTE · ANONYMIZED
A recent audit, redacted.
From a 12-day engagement with a Russian document-management SaaS, May 2026. Names removed, findings preserved.
EXECUTIVE SUMMARY — ANONYMIZED
9 P0 · 19 P1 · 15 P2 · 1 P3
+ 18 positive findings
[CRITICAL] Full multi-tenant bypass via JWT impersonation. Any authenticated user can become ADMIN of any other company on the platform with 3 lines of JavaScript in the browser console. Verified end-to-end.
[CRITICAL] Webhook signature verification fails open in production. 60 fail-open warnings + 57 unauthenticated callbacks in the past 12 days of production logs.
[CRITICAL] PostgreSQL connection instability — 1320 FATAL `terminating connection due to idle-session timeout` errors in 12 days. 6.7% of all log lines. Root cause: Prisma connection pool not configured for keepalive against Timeweb Postgres.
— 6 more P0 findings, 19 P1 findings, full fix plan, and a Sprint 1 roadmap delivered in the final report. Client gave permission to share this summary, anonymized.
+ 18 positive findings
[CRITICAL] Full multi-tenant bypass via JWT impersonation. Any authenticated user can become ADMIN of any other company on the platform with 3 lines of JavaScript in the browser console. Verified end-to-end.
[CRITICAL] Webhook signature verification fails open in production. 60 fail-open warnings + 57 unauthenticated callbacks in the past 12 days of production logs.
[CRITICAL] PostgreSQL connection instability — 1320 FATAL `terminating connection due to idle-session timeout` errors in 12 days. 6.7% of all log lines. Root cause: Prisma connection pool not configured for keepalive against Timeweb Postgres.
— 6 more P0 findings, 19 P1 findings, full fix plan, and a Sprint 1 roadmap delivered in the final report. Client gave permission to share this summary, anonymized.
CHECKLIST
Audit your own SaaS first.
A free 32-point checklist combining OWASP Top 10, 152-ФЗ readiness, and production stability. Read it now or send the link to your inbox.
No newsletter. No drip funnel. One email with the checklist link, then we leave you alone.
FAQ
Questions we get.
Do you need access to our production database?
Ideally read-only access, yes. If that’s a blocker, a sanitized SQL dump works for most checks. We sign an NDA either way and we run our own PII sanitizer (Anonymous) over any logs you send before they touch any cloud tool.
Will you exploit findings on production?
Only with explicit written permission and with you watching. Default mode is static + low-impact runtime probes. The JWT bypass demo from the example above was run on a staging copy first, then reproduced on production with the client’s engineering lead in the room.
What about the deliverable?
A markdown report with severity-tagged findings (P0 / P1 / P2 / P3), reproduction steps, fix recommendations, and a Sprint 1 roadmap. Plus a 60-minute walkthrough call with your team. No 80-page Word documents.
Who actually runs the audit?
Every audit has one accountable lead from the studio, who signs the report. The method is on this page, so you can judge the scope before you book.
Do you have an ФСТЭК licence?
This is a technical audit, not a certification. If your project requires a licensed assessment or a legal opinion, arrange that as a separate engagement with an appropriately qualified provider.
How fast can you start?
Typical lead time is 1–2 weeks from signature to kick-off. Express Audit fits a 2-week sprint, Full Audit a 4-week one. We confirm the exact start date before signing.
START
Ready to look?
Discuss your product on a call, or send a brief if you already know what you need.