Why me
I shipped this exact bug. I caught it before a customer did.
I ship fast, same as you. My own SaaS is mostly built with AI, and one day I realized any user could change an ID in a request and read another user's records. Classic IDOR, plus a database policy left wide open. It worked flawlessly every time I tested it, which is exactly why it almost shipped.
Closing that whole class of bug is what Watertight now does for you, on your app, before it costs you a customer.
GET /invoice/1045
→ 200 OK (yours)
# works just as well for a stranger
GET /invoice/1046
→ 200 OK (someone else's)
What I check
The holes that sink launches
The same handful show up in almost every app shipped fast. None appear when you use your own product normally. That is the whole problem.
Read anyone’s data (IDOR)
Change a number in the URL, load a record that isn’t yours.
Public database
Supabase or Firebase readable by anyone holding your public key.
Price set in the browser
Checkout trusts what the client sends. So the client sends less.
No rate limit
One script on a paid endpoint. One frightening weekend bill.
Forgeable auth
Hand-rolled tokens anyone can mint, including as admin.
Secret key in the frontend
The service key that skips every rule, sitting in your bundle.
Listable storage
Private files stay private only until someone lists the bucket.
SSRF & prompt injection
Your server fetches any URL. Your AI follows any instruction.
How it works
Three steps. Seventy-two hours.
Send your URL
You give the go-ahead and a test login. That is all I need to start. Nothing runs without your OK.
I find the holes
Your app, checked against the top 10 holes that sink launches. I capture proof of the real ones on your own app.
You get the fix
A short, plain report. Every hole, its severity, the exact fix. In 72 hours, not 72 pages.
Straight talk
“Can’t I just run a scanner, or ask my AI to check itself?”
Scanners miss the holes that actually leak, and worse, they tell you confidently that you are fine when you are not. A human who has shipped this exact class of bug checks the things a generic tool skips, and shows you the leak on your own app instead of a vague warning.
“Do you guarantee my app is secure?”
No, and anyone who does is lying. I find the holes that sink 90% of launches and show you the proof. A clean report means you are clear of those, not that you are unhackable. That honesty is the point.
Pricing
Find the leak
before it finds you
Free check
$0
See it is real before you pay
- ✓Your top 3 holes
- ✓One proven on your own app
- ✓No card, no commitment
Launch audit
$249
The full sweep, ship safe
- ✓All top 10 holes checked
- ✓Report with the exact fix for each
- ✓Screenshot proof of the critical ones
- ✓72-hour turnaround
Deep audit
$499
I read the code, then re-check
- ✓Everything in Launch
- ✓Reads your real access policies & auth
- ✓Re-audit after you patch
- ✓Confirms each hole is closed
Start with the free check. No commitment until you have seen a real hole on your own app.
FAQ
Common
questions
Everything you need to know before you send a URL.
What do you need from me?
A URL, a test login, and your explicit OK to test it. Nothing more, and nothing runs before you say yes.
Is it safe to give you access?
Yes. I work from a test account, all checks are non-destructive and read-only unless we agree otherwise, and I only ever test an app you are authorized to have tested.
What stacks do you cover?
Apps shipped fast on Supabase, Firebase, Next, custom API routes, and similar. Managed platforms like Shopify or Webflow are not a fit, since the platform owns that security.
How fast is it?
The free check is same or next day. A full Launch audit lands within 72 hours.
What do I actually get?
A short, plain-English report: every hole found, how serious it is, a screenshot proof of the critical ones, and the exact fix for each. Built to read in minutes, not a 200-page PDF.