Can someone steal your customer base?
Emails, personal data, payment history. The flaw I find most often, and the worst. The day it leaks, you've got the regulator on your back and customers walking out.
I get into your SaaS before the attacker.
A SaaS doing several million in revenue. I took control in under an hour.
Free · results in a minute · no commitment
For SaaS with customers to protect. Not for those starting out with no budget.
Proof
They saw it live, on their own SaaS.
A sample of what I find
Real flaws, on real SaaS, anonymized and already fixed.
Critical
Full access to the customer database with a simple free account.
Critical
One customer could read and edit another customer's data.
Critical
Download any user's private content (videos, files).
Critical
Other users' emails and personal data leaking continuously.
High
You could grant yourself the admin role via the signup API.
High
Other accounts' private analytics, accessible with no login.
High
Profile photos and user IDs retrievable from cloud storage.
High
Proprietary AI content (prompts, scenarios) readable by others.
Deep down, you know your SaaS has never really been tested.
Scan my SaaS, freeIn a minute, what an attacker sees from outside.
About
I'm a founder. I code on the same stack as you.
I've been building SaaS for years, on Supabase, Next and Stripe. The same stack as you. I know your weak spots because I made them myself, before I learned to find them. Today I test other people's SaaS, always with their written go-ahead.
“I paid a real dev team, so I'm safe.” That's the sentence I hear most, and it's the most dangerous. Budget protects nothing. An app can be clean, fast, well coded, and still leave the front door wide open. The more customers you have behind it, the more it hurts the day it leaks.
What I check
What an attacker targets on your SaaS.
I look at your SaaS the way someone who wants in would, and I tell you exactly what breaks.
Can one customer see another's data?
The nightmare once you have several customers. One oversight somewhere, and each one can read what belongs to the others.
Can someone cheat your payments?
Pay less than planned, slip past the paywall, replay a transaction. I test your payment logic for real, not on paper.
Are your keys and access exposed?
Passwords, API keys, admin access left in the code sent to the browser. Very often it's visible without forcing anything.
Not ready for a full audit yet?
Start with the free scan. In a minute, what an attacker sees of your SaaS from outside, no commitment.
Pricing
Prices are shown. No fuzzy quotes.
You know where you stand before we even talk. Two paid offers, that's it. The kind of report you use to pass a client security questionnaire or get SOC 2 ready. Start small, or go straight for the full audit.
Free
The scan
What an attacker sees of your SaaS from outside, in a minute. No need to talk to me.
Run the scan →$990
The one-day pentest
I spend a full day on your main surface and hand you a clear report of the flaws I find. The right place to start before going further.
Book it →$2,900 · most popular
The Zero-Leak audit
The deep audit of your SaaS: customer base, isolation between your customers, access, keys, payments. We get on a call to go through everything, you get the report with the fixes, and I come back to check once you've patched. It's what most clients use to pass a security review or prep for SOC 2.
Book it →Custom
Bigger, or more complex?
If your SaaS is heavy or the scope goes beyond this, we set up something tailored. We talk it through on the call.
Let's talk →How it works
The method, in 3 steps.
Three steps, and your written go-ahead first, always.
01
We scope it
We decide together what I test, and you give me your written go-ahead. I don't touch anything without it.
02
I test like a real attacker
I look for where your SaaS leaks, and I prove it, without breaking anything.
03
You get a clear report
The problem, the proof, and how to fix it, in plain words. You get it as a PDF, and also in a version ready to paste into Cursor or Claude Code. Once it's fixed, I come back to check, that's included.
FAQ
Questions & answers.
I paid a real dev team, shouldn't I be safe?
It's the most dangerous belief there is. Most of the SaaS I test have a serious flaw, even the ones that spent a lot on dev. Budget protects nothing.
What's this about a stolen customer base?
On most SaaS, I manage to pull the whole base (emails, personal data, payments) pretty fast, without really hacking anything. It's usually a simple configuration mistake. And for GDPR, it's the worst case there is.
Do you only test SaaS?
Yes, on purpose. I know the SaaS stack (Supabase, Next, Stripe) from the inside because I build on it. That's where I'm fastest, and where I find what others miss.
Is this legal?
Only with your written go-ahead, on a scope we define together. No go-ahead, no test.
How much does it cost?
The prices are shown above, you see them before you contact me. What changes from one SaaS to another is the scope, and we set that together on the call.
Book a call
We talk to start, not to chat about it.
I'm not a salesperson, and this call isn't here to convince you. You've seen the prices. If it's in your budget and you want to move, we grab a slot and we start the audit at the end of the call. No ‘let's talk again next month’. If you're just starting out with no budget, run the free scan instead, we'll talk when the time is right.
Calendar not loading? Open it in a new tab →