Shipped with AI. Now hitting real users?

Start with the running system. Static analysis tells us the shape; runtime observation tells us the truth. AI-built codebases rarely have docs — we treat that as a finding, not a blocker

For a focused engagement, yes. Two engineers, three days, a defined scope (typically a single MVP) — that's enough to surface the production-blockers. Bigger codebases get scoped to the riskiest subsystem first.

No. The report stands alone. Some take the action list in-house. We provide a fixed-price quote if you want us to do the work — it's optional, on a clean second contract.

We tell you at scoping. If a codebase doesn't fit in three days, we scope to the highest-risk subsystem and propose a follow-on. We don't pad the timeline.

The read-out call is where you push back. We defend rankings with code references and blast radius. Engineers with context we missed adjust the rankings.

Always. We sign engagement-specific NDAs before any code access. Read-only credentials, time-limited, revoked at the end of engagement.

Defined on the scoping call against your context — funding stage, customer segment, regulatory posture, scale targets. Production-worthy for a seed-stage B2C is not the same as a Series-B fintech.

Yes. If you already know security (or performance, or test coverage) is the gap, we scope around that single dimension and go deeper.

The executive summary is built for the board. The findings list is built for the engineering team. A security baseline is built for compliance review. Same document, different audiences.