Find what's exposed before your users do.
We audit your site or app for real vulnerabilities (SaaS, e-commerce, or anything web-based), whenever you need it, not just before launch. Especially critical if it was built fast with AI tools like Cursor, Claude Code, Lovable, or Bolt, which quietly ship the same mistakes.
€395 to start · NDA by default · Read-only access
Security Review Report
acme-app · reviewed Jul 14
Security score
/ 100
Findings by severity
- Row-Level SecurityCritical
- Public Storage AccessWarning
- API Key ExposureWarning
- Authentication FlowPassed
Is something in your app exposed right now?
One command. 60 seconds. Run it on your own app.
No spam. The test, then nothing unless you ask.
Tested on our own products, then validated on real client engagements
AI helps you ship faster.
It also helps you ship vulnerabilities faster.
| Symptom | Cause | How we check it | |
|---|---|---|---|
| Broken RLS | Your app works perfectly, but any user can see another user's data through the API. | Row-level security missing or misconfigured on your database tables. | Table-by-table policy audit, verified with a two-account cross-access test. |
| Leaked API Keys | Everything runs fine until someone opens dev tools and finds a key that shouldn't be there. | Secret keys committed to the repo or shipped straight to the browser bundle. | Full scan of source code and the client bundle for exposed keys and tokens. |
| Public Storage | A file you thought was private shows up in a search engine or a random link. | Storage buckets left open, indexable, and downloadable by anyone. | Bucket-by-bucket access test, with and without authentication. |
| Weak Authentication | Someone can hammer the login form as many times as they want. | No rate limiting, weak sessions, or missing checks on auth flows. | Login, reset, and session flows tested against repeated and forged attempts. |
| Exposed Secrets | The app works fine in production, but nobody's sure which environment variables are actually private. | Environment variables and tokens visible in client-side bundles. | Client bundle audited line by line for anything that shouldn't be public. |
| Prompt Injection | A user pastes something strange into a text field and your AI feature starts doing things it shouldn't. | Unvalidated inputs let users hijack your AI's instructions. | Input handling reviewed against known prompt-injection patterns. |
This isn't hypothetical: in 2025, security researcher Matt Palmer found that 170 of 1,645 scanned Lovable apps (about 10%) had missing or misconfigured Supabase row-level security, exposing user PII, API keys, and payment data across 303 endpoints. (CVE-2025-48757, mattpalmer.io)
Traditional security reviews miss AI-built apps.
AI-built applications fail differently, and much earlier, than what traditional pentest checklists are built for.
| Traditional pentest | Validra | |
|---|---|---|
| Price | €5,000–€20,000+ | €790 (€395 to start) |
| Turnaround | 2–6 weeks | 5 business days |
| Scope | Broad infrastructure checklist | AI-specific failure modes: RLS, secrets, auth, webhooks |
| Deliverable | Generic compliance-oriented report | Plain-English report, prioritized, with a walkthrough call |
Real vulnerabilities, found on real projects.
Three anonymized examples of what we actually find, not theoretical scenarios.
Complete bypass of row-level security rules
Supabase RLS policies were misconfigured, letting any authenticated user read and modify other users' transaction data through direct REST API calls, without ever going through the UI.
Business impact
Exposure of financial data for every user on the platform.
Authentication token exposed in URL parameters
A JWT was passed as a query parameter instead of a secure header, ending up logged in plain text in server logs and browser history.
Business impact
Risk of session hijacking for anyone with access to logs or browser history.
Public storage bucket with no access restrictions
Documents meant for internal use only were publicly accessible via a predictable URL, with no authentication required.
Business impact
Exposure of confidential company documents to anyone who knew or guessed the URL.
Anonymized examples from real engagements. Details modified to protect client confidentiality.
What we check, and what you get.
Six critical categories, checked with automated tooling and manual testing. Delivered as a clear, prioritized report, plus a call to walk through it with you.
Submit your project.
Share your repo or staging URL. It takes less than five minutes.
We review your application.
Automated scanning plus a manual pass from someone who ships AI-built products themselves.
Receive a prioritized action plan.
Clear, ranked fixes your team can act on right away, without jargon.
Row-Level Security (RLS)
We map the tables your app exposes through the API, then attempt cross-account access between two real test accounts on each one to confirm real data isolation.
Secrets management
Source code and the shipped JavaScript bundle are analyzed to catch any key or token exposed on the client side.
Storage permissions
Each storage bucket is tested with and without authentication to identify unintended access.
Authentication flows
Login, password reset, and session handling are tested, checking for rate limiting on repeated attempts.
API surface
We enumerate your exposed endpoints and test them unauthenticated, then again with a lower-privileged role, prioritized by what actually touches user data.
Third-party integrations
Webhook signature validation (Stripe and others) is checked to prevent forged requests.
Delivered as
Anatomy of a finding in your Validra report
CRITICAL · Cross-Tenant IDOR on Invoice Export (/api/invoices/[id]/export)
# Test cross-tenant access with Tenant B token on Tenant A's invoice:
curl -i https://api.yourapp.com/v1/invoices/inv_9842/export \
-H "Authorization: Bearer <tenant_b_jwt>"
# Exploitation confirmed: HTTP 200 OK
{
"id": "inv_9842",
"org_id": "tenant_a_uuid",
"amount": 4900,
"client": "victim-enterprise@corp.com"
}// src/app/api/invoices/[id]/export/route.ts
- const invoice = await db.invoice.findUnique({ where: { id } });
+ const session = await auth();
+ const invoice = await db.invoice.findFirst({
+ where: { id, organizationId: session.orgId },
+ });
+ if (!invoice) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }No generic 80-page scanner dumps. Every vulnerability is proved with a reproducible PoC and an exact code fix ready to merge.
Built by SaaS founders.
I build my own AI products. I know the shortcuts.
I know the mistakes AI coding tools still make.
I review products like a founder, not an auditor.
I don't start from a generic checklist. Every engagement sharpens my methodology: I document every mistake I find across Supabase and Next.js stacks, and the AI coding tools founders actually use today (Cursor, Claude Code, Lovable, Bolt, v0).
Téo Brondel
Founder, Validra
Founder of Validra. I've been building SaaS products for over two and a half years, long enough to see, firsthand, every security issue AI quietly introduces into code. Catching them before they turn into a breach became non-negotiable.
5 days
Average review turnaround
Live
New audits underway right now
6
Critical categories checked
Systematic severity rating
Every finding is ranked by real business impact, not just a technical score.
Documented methodology
Automated scanning plus manual testing of authentication, RLS, APIs, and storage.
One review. Straightforward terms.
A single, focused engagement, not a menu of add-ons. No seats, no contracts, no enterprise sales calls.
Validra Security Review
A targeted, evidence-based security review of your application. We map your sensitive surfaces, run targeted manual tests, validate every finding, and hand you a prioritized report you can act on.
- Sensitive surfaces mapped: auth, data access, secrets, APIs, third-party integrations
- Targeted manual testing, not a generic automated scan
- Every finding validated and rated by confidence: observation, weakness, or demonstrated vulnerability
- Risk-prioritized report, written in plain English
- Walkthrough call to go through every finding together
- Remediation recommendations — you or your developer implement the fixes
- One limited retest, included in the engagement
How payment works
You pay €395 to start. The remaining €395 is due only if the review finds security issues relevant to the agreed scope. If nothing relevant turns up within that scope, that's the only payment you make.
€395 to start · balance due only if we find something relevant
Findings are limited to what the agreed scope allows us to test. This isn't a guarantee that no other issue exists, and it isn't a certification.
Pick this if, don't if.
Pick this if…
- You're launching this week and want a clear go/no-go
- You just found an exposed key or an RLS gap and need it confirmed
- Investor or customer diligence is coming up
- You built with Lovable, Bolt, or Cursor and never checked the access rules
Don't pick it if…
- You're mid-breach right now — email me directly instead
- You need HIPAA, SOC 2, or PCI accreditation, not a technical baseline
- Your codebase is 100k+ lines — let's talk scope first
Good questions.
Do you sign an NDA?
Yes. We sign an NDA before we look at a single line of your code.
Do you need GitHub access?
Read-only access is enough. We never need write or admin permissions.
Which frameworks do you support?
Next.js, React, Supabase, Firebase, and most modern stacks, including AI-assisted tools like Cursor, Bolt, Lovable, and v0.
How long does it take?
About 5 business days from when we receive access and the information we need.
Can you fix the issues?
No — we identify, validate, and prioritize them, and hand you clear remediation recommendations. Implementing the fixes is on you or your developer; that separation is what keeps the review independent.
Is my source code confidential?
Always. Your code is reviewed under NDA and never stored longer than the engagement requires.
Do you work with pre-launch projects that don't have real users yet?
Yes. That's actually the ideal time — before real user data is on the line.
What happens if you don't find anything relevant?
You still get the full report, confirming what was tested and the state of the surfaces we covered. And you only pay the initial €395 — the remaining €395 is due only if we found security issues relevant to the agreed scope.
How much does a SaaS security review cost?
A full Validra Security Review costs €790 fixed (€395 initial deposit, and the remaining €395 only if actionable security issues within scope are found). This fixed pricing is designed specifically for early-stage SaaS and startups as a transparent, high-impact alternative to traditional penetration testing firms that charge €5,000 to €15,000+.
Why choose a manual review over automated vulnerability scanners?
Automated scanners only flag outdated dependencies and generic CVEs. They cannot evaluate custom business logic, test multi-tenant data isolation, or spot database permission flaws (like Supabase Row-Level Security bypasses or IDOR vulnerabilities where user A reads user B's workspace). Validra combines targeted manual penetration testing and source code inspection to test what automated scanners miss.
What is a Production Readiness Review for a SaaS application?
A Production Readiness Review is a targeted security assessment performed before launch or scaling. Validra audits 6 critical surfaces: database access controls (Row-Level Security), authentication & session handling, exposed secrets and API keys, storage bucket permissions, API endpoint authorization (IDOR), and third-party integrations (such as Stripe webhooks).
Is Validra a cheaper alternative to traditional penetration testing?
Yes, a Validra review costs €790 compared to the €5,000 to €15,000+ typical of traditional penetration tests. We use the same manual methodology and deliver in 5 days instead of 3-4 weeks. The difference is our focused scope: we target SaaS-critical surfaces (Row-Level Security, IDOR, authentication, API keys) rather than full network infrastructure.
Can Validra audit my SaaS before a fundraising due diligence?
Yes, and it's the perfect timing. Investors increasingly require security audits during due diligence. Our report format is suitable for sharing with investors or your board, our 5-day turnaround fits deal timelines, and everything is conducted under a strict NDA.
Does Validra test for OWASP Top 10 vulnerabilities?
Yes, we apply the OWASP Top 10 methodology (including the latest 2025 standards) plus SaaS-specific business logic tests. We look for multi-tenant isolation failures, RLS bypasses, and IDOR vulnerabilities that go far beyond generic OWASP categories.
What is the difference between Validra and automated scanners like Snyk or SonarQube?
Automated scanners check dependencies and syntax patterns, but they cannot test business logic, multi-tenant data isolation, or database permission models. Validra performs targeted manual code review and penetration testing to catch the logic flaws scanners miss.
Can I get a SaaS security audit delivered in under a week?
Yes, we guarantee a 5 business days turnaround. This covers everything from receiving access to delivering the final prioritized report with remediation recommendations, and scheduling the 30-minute walkthrough call.
Is a €790 security audit legitimate or just an automated scan?
It's a genuine manual review. The affordable price is possible because Validra focuses specifically on the 6 critical SaaS attack surfaces rather than conducting a broad network penetration test. Every finding includes a verified Proof-of-Concept and actionable code fix.
25 mistakes AI coding tools still make in production.
6 categories, 25 vulnerabilities, freely available
Ready to see what's exposed?
Get a clear, prioritized report you can act on right away.