Fixed fee · £1,000, one-off
AI security auditAn AI-driven scan of your software, with every finding checked by an engineer. AI models have become good at finding security flaws, and attackers have them too. With your written permission, we point ours at your code and at the parts of your system that face the internet, and tell you what they found in plain English.
Ask about AI security audit
invoices/export.ts Reading the code
1 export async function exportInvoice(req, res) {2 const inv = await invoices.find(req.params.id);3 if (!inv) throw Error("Missing " + filePath);4 const file = await renderCsv(inv);5 res.download(file);6 }High Any customer can export any invoice Checked Low The error reveals a file path Checked An illustration of a scan.
What a finding looks likePlain English, with the evidence and the fix. Finding 1 of your report
High
One customer can download another customer's invoices
Where The invoice export, at /api/invoices/:id/export
Evidence Signed in as one customer, we requested an invoice belonging to another, and the file was returned.
Fix Check that the invoice belongs to the signed-in customer before exporting it. The change is four lines, and it is included.
Checked by A senior engineer, who reproduced it by hand. An illustration of one finding. Yours will name your own code. 01 Authorise the scope You tell us which application to scan and confirm in writing that we may test it.
02 We run the scan Our models read the code and test the parts that face the internet. A senior engineer checks each finding.
03 You receive the report A ranked list of findings, each with its evidence and a recommended fix.
What you get A ranked list of findings The most serious first, so you know what to fix today and what can wait.
Evidence and a fix for each Where the flaw is, how we showed it, and the change we recommend.
Checked by a senior engineer An engineer confirms every finding before you see it, so you are not sent a list of false alarms.
One fixed price £1,000 for one application: its code, its dependencies and what it exposes to the internet.
What it is, and what it is notAn honest scan is clear about its limits. What it is An AI-driven review of one application: its code, its dependencies and what it exposes to the internet. Run on open-weight models that we host ourselves. Checked by a senior engineer before anything reaches you. What it is not It is not a CREST-certified penetration test. It does not replace one where a contract, an insurer or a regulator asks for it. It is not a promise that nothing else is wrong. No scan finds everything.
How it comparesThree ways to have your software checked. A penetration test
What looks at your system Certified testers, working by hand
What you receive A formal report you can show a regulator
When to use it When a contract, an insurer or a regulator requires one An automated scanner
What looks at your system Fixed rules and known signatures
What you receive A long list to sort through yourself
When to use it All the time, for known problems AI security audit
What looks at your system AI models reading your code, checked by an engineer
What you receive A short ranked list, with a fix for each finding
When to use it Between formal tests, or before a launch or due diligence
Questions
Is this a penetration test? No. It is an AI-driven scan checked by an engineer. Where a contract, an insurer or a regulator asks for a CREST-certified test, you still need one.
What do you need from us? Written permission, read access to the code, and the addresses of what faces the internet.
Where does our code go? The scan runs on open-weight models that we host ourselves, so your code is not sent to a public AI service. What happens after the report? The findings are yours to fix. If you would rather we fixed them, that is work we take on through Unlimited development .
Other ways to work with us Our product, the Company Twin, has its own site. Visit mlx.systems