AI-product startups
You are shipping an LLM feature or an agent
A small engineering team selling to businesses that will ask security questions. You need a senior review before the customer's questionnaire arrives.
Security review for AI-built software
A senior engineer reviews what your AI wrote.
AI wrote it fast; we check it carefully. The Launch Security Check is a fixed-price security review of an app built with Cursor, Lovable, Bolt, Replit or Claude Code, with findings ranked by real exploitability.
- Launch Security Check
- from US$790 fixed once scope is confirmed
- Report delivered
- within two business days of confirmed scope, payment and access
- You get
- Report + 30-min walkthrough
Get a fixed quote
Short request form, no call needed · or email hello@proofmerge.com
Finding formatIllustrative example
HIGH
Table profiles is readable without a session
- Where
public.profiles, row level security disabled- Impact
- Anyone holding the public anon key can read every row.
- Fix
- Enable RLS and restrict reads to the owning user.
+ alter table public.profiles enable row level security;
+ create policy "own row" on public.profiles
+ for select using (auth.uid() = id);- 10+ yearsin security engineering, 5+ in application security
- Human-confirmedevery finding checked by a senior engineer before it reaches you
- NDA and read-onlywritten authorization first, no production data, no live keys
- 1 business dayto a written scope, fixed price and start date
Who it is for
Teams that ship faster than anyone can review
The code works. Nobody senior has checked the secrets, the authentication, the database rules, the exposed APIs or the dependencies.
Founders and solo builders
You built the product with AI tools
Cursor, Lovable, Bolt, Replit or Claude Code got you to a working app. You want to know what is exposed before real users and real data arrive.
Software agencies
You build AI apps and MVPs for clients
You need a security partner to review a build before handover, under your brand if you prefer, or to help answer a client's security questionnaire. How white-label and referral reviews work
What gets checked
Five areas we check in every AI-built app
Automated scanning does the first pass. The ranking and the conclusions are human: each finding states where it is, what an attacker could do with it, and how to fix it.
Secrets
API keys, tokens and credentials in the repository, its history, or the code shipped to the browser.
Authentication
Sign-in, sessions and authorization: who can reach which route and which record.
Database rules
Access rules on your data, for example Supabase row level security policies.
API exposure
Endpoints that answer without the checks the interface assumes are there.
Dependencies
Third-party packages with known vulnerabilities, and what they mean for your app.
We say what was reviewed and what was not. A clean report means we found nothing in the agreed scope; it does not mean the product is secure.
Offers
Fixed scope, fixed price, in US dollars
Start with the check. Step up only if the findings or your product call for it.
-
Start here
Launch Security Check
For apps built with Cursor, Lovable, Bolt, Replit or Claude Code. Secrets, authentication, database rules, API exposure and dependencies. Report plus a 30-minute walkthrough. Next.js + Supabase: what we check
from US$790 fixed once scope is confirmed · report within two business days of confirmed scope, agreed payment arrangements and complete access
-
LLM features and agents
AI Agent & LLM Security Sprint
Prompt injection, data leakage, agent and tool permissions, MCP integrations. Mapped to the OWASP Top 10 for LLM applications. What the sprint reviews
Quote on request fixed price in writing after a free scoping call
-
We fix it
Fix Sprint
We remediate the findings and install a CI/CD security pipeline (SAST, secrets, SCA and IaC scanning) so they stay fixed.
Quote on request after the report walkthrough
-
Infrastructure
Cloud & CI/CD Security Assessment
Review of AWS, GCP or Azure together with GitHub or GitLab, delivered as a prioritized remediation plan.
Quote on request fixed price in writing after a free scoping call
Prices are the current launch offer, in USD, for the scope agreed in writing before work starts. US$790 covers one small application; larger or multi-service codebases are quoted after the scoping call.
Services
Beyond the security check
The same engineering, applied to building and running software. Scoped per project after a short call.
Launch Security Check
Independent, human-reviewed security assessment before production launch. From US$790 for a confirmed small-app scope.
AI Automation & Workflow Development
Agents and automations that connect your tools and remove manual steps, built with access controls and logging from the start.
DevSecOps & Cloud Security Consulting
CI/CD pipelines with security checks built in, cloud configuration reviews on AWS, GCP or Azure, and hands-on remediation.
Tools & Templates
Coming later: downloadable checklists and automation templates from our own delivery work. Nothing is on sale yet.
Automation and consulting work is quoted per project. Write to hello@proofmerge.com with what you want to build or review.
Shipping an AI agent or LLM feature? See AI agent security. Building apps for clients? See security reviews for agencies.
How it works
Four steps, no surprises
Scope and NDA
A short call to agree what is in scope and what is not. We sign an NDA and you authorize the review in writing before anything is shared.
Read-only access
You grant read-only access to the repository and the relevant configuration. You control the access and remove it when the work is done.
Review
Automated scanning runs first. A senior engineer then reads the code and configuration, confirms what is real, and ranks it by exploitability.
Report and walkthrough
You receive the written report, then we go through it together on a 30-minute call so your team knows what to fix first.
The Launch Security Check report is delivered within two business days of confirmed scope, agreed payment arrangements and complete access.
What the report looks like
Not a scanner dump
A short document your engineers can act on the same day.
- Ranked by real exploitability. What an attacker can actually reach comes first.
- Specific. File, table or endpoint, the impact, and the fix.
- Honest about scope. A list of what was reviewed and what was not.
report structure
- Summary and scope01
- Findings, ranked02
- Evidence and impact03
- Recommended fixes04
- Reviewed / not reviewed05
About
Over 10 years of security engineering behind every report
Proofmerge is an independent security and engineering practice led by a senior DevSecOps and security engineer. We read AI-generated code as both the engineer who has to ship it and the reviewer who has to find what is wrong with it.
Every review is done by a senior engineer personally. There is no hand-off to a junior team and no report assembled from tool output alone. Proofmerge is independent: no reseller agreements, no tools to sell you and no audit badge for sale, only findings you can verify yourself.
- 10+ years in security engineering, 5+ in application security
- Remote-first, serving teams worldwide across time zones
- Engagements in English, German and Polish
Getting started
Start with one short request
No sales sequence. Tell us a few things, by form or by email, and you get a scope, a fixed price and a start date back by email, usually within one business day.
What you built
The product in one line, the stack, and which AI tools wrote the code.
How big it is
A rough count of files or services, so the scope and the price are honest.
What it handles
Accounts, payments, personal data, LLM features or agents.
When you launch
Your date or deadline, and when you could take a 15-minute call.
Nothing sensitive yet
Do not send code, credentials or access. That comes after a signed scope and your written authorization.
Authorization in writing
Nothing is reviewed until you authorize it in writing and an NDA is signed. You decide the scope.
Read-only, minimum access
Read-only access to the repository and configuration. No production data, no live keys, and you remove access when the work is done.
Evidence you can check
Each finding shows the file or table, the impact and the fix. Secret values are redacted and never reproduced in the report.
Open a pre-filled email → or write to hello@proofmerge.com. Agencies: ask about reviewing your client builds under your brand.
FAQ
Questions a CTO asks first
What access do you need, and how is it kept confidential?
Read-only access to the repository and to the configuration in scope, such as database access rules. We do not ask for write access for a review.
An NDA is signed before you share anything, and work starts only after you authorize it in writing. You grant the access yourself and remove it once the report is delivered.
Is this a penetration test or a certification?
No. It is a security review of your code and configuration, done with access you grant. It is not a penetration test, and it is not a certification or an audit opinion.
We do not issue SOC 2 reports or ISO 27001 certificates. The report describes what we found in the agreed scope at the time of the review.
What is in scope, and what if my app does not fit?
The Launch Security Check covers one application: secrets, authentication, database rules, API exposure and dependencies. Scope is agreed in writing after the scoping call, in the statement of work, before any invoice.
If your product is larger or runs LLM features and agents, we will say so on the call and point you to the right step of the ladder instead of stretching the check.
How do I pay?
The price is fixed for the agreed scope, and payment terms are agreed in writing before work starts. There is no checkout on this site and we never ask for card details by email.
Can you fix what you find?
Yes, as a separate Fix Sprint, quoted after the report walkthrough. We remediate the findings and install a CI/CD security pipeline so the same issues are caught before the next merge.
Proof before you merge
Fixed price. Report within two business days of confirmed scope, agreed payment arrangements and complete access. Findings ranked by real exploitability.
Tell us what you built and what it was built with. We reply with times for a short scoping call.
No mail app? Write to hello@proofmerge.com