And if it needs more than a deploy

Most audits turn up work worth doing beyond the two fixed prices above — real authentication where there was none, database access rules, moving secrets off the front-end, or the performance work that stops it collapsing at fifty users.

That work is quoted individually, as a fixed price, from what the audit actually found. There is no obligation attached to buying an audit: plenty of people take the document and do the work themselves or hand it to their own developer, which is exactly what it is written for.

What changes the price

• How much of it is broken. An app that runs but is insecure is a smaller job than one that will not start.
• Whether the data model can stay. Fixing access rules is cheap. Restructuring the data underneath them is not.
• How many external services it touches. Every payment provider, auth provider and third-party API is another thing to configure correctly and test.
• Whether you need to keep editing it in the original tool. Keeping a project round-trippable back into Lovable or Bolt constrains what we can change, and that costs time.

What we never charge for

• Telling you whether we can help. Send us the repo or URL and we will say yes or no before you pay anything.
• Scoping and quoting. However long it takes us to work out what a job involves, that is our cost.
• Overruns. If we quoted wrong, that is our problem.
• A review that finds nothing worth fixing. If that happens, you get the audit fee back.

How payment works

Payment is taken up front through our payment provider, in US dollars. The turnaround clock starts when we have working access to your code, not when the payment clears. Full terms are on the terms page.