Clerk security review cost: $2,400 once, you own it
Clerk security review cost is $2,400 once for one app, $1,200 to start. You own the report. No subscription. Org roles, session, and the API.
In this article· 6 sections
Clerk security review cost is $2,400 once for one app that signs people in with Clerk. $1,200 starts the work. The report is due 48 hours after a test user can sign in. You own the PDF. There is no subscription.
A Clerk invoice is not that test. Pro pays for the auth product. This pass checks whether your API believes the session.
Short answer: Clerk security review cost is $2,400 once, with $1,200 to start, for one app that signs in with Clerk. I check organization roles, the session, and the API those pages already call, then write the report 48 hours after access works. You own it. Clerk Pro and a multi-week accredited pentest are different products. The offer is the web application security review.
What does a Clerk security review cost?
$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying Clerk’s monthly plan, a scanner seat, or a stamp I do not hold.
Clerk’s pricing page lists Pro at $25 a month, or $20 billed annually, with MFA and a custom session lifetime. Business is $300 a month, or $250 billed annually, and that plan includes Clerk’s SOC 2 report. The B2B Authentication add-on is $100 a month, or $85 billed annually, for unlimited members and custom roles. Every plan already includes organizations, Admin and Member, and a 20-member cap.
| What you are buying | 2026 price | What you actually get |
|---|---|---|
| Clerk Pro | $25/mo, or $20/mo annual | The auth product. Not a test of your API |
| Clerk Business | $300/mo, or $250/mo annual | Clerk’s SOC 2 report and more dashboard seats. Still their controls |
| This Clerk review | $2,400 once, $1,200 to start | One app, org roles, session, the API the UI calls, report in 48 hours, one retest |
| Small SaaS web app, market | $2,500–$15,000, or $4,000–$12,000 | Longer calendar, often packaged for a compliance conversation |
WardenBit’s 2026 small-business guide puts most web app projects between $2,500 and $15,000, and $100–$3,000 as mostly automated scanning. SecureLeap’s startup table lists a small SaaS web app at $4,000–$12,000.
Pro at $25 a month is $600 over 24 months and $900 over 36 months. Business at $300 a month is $7,200 and $10,800. The B2B add-on at $100 a month is $2,400 over 24 months, the same sticker as this review, for a different product. Three passes of this review, a year apart, are $7,200.
The same $2,400 is on pricing. If the UI is Next.js, route-handler notes sit in Next.js security review cost. That post does not walk Clerk organization claims.
What does that $2,400 actually open?
I sign in as the roles you already sell and record which organization those sessions can reach. The pass covers the pages, the session Clerk issued, and the API those pages already call. Your Clerk secret key stays off the browser and off this engagement.
Clerk’s authorization checks are the bar:
- A role check needs an active organization. Without one, Clerk says those checks tend to come back false.
- Server-side permission checks only see custom permissions. System permissions are not in the session token, so I check the role.
- A member of org A should not read org B through a call the UI already makes.
- Manual JWT verification says to check the
azpclaim. Skipping it is a CSRF risk Clerk names. I record whether your API does. I do not ship a recipe. - With personal accounts off, signup without an organization can leave a
pendingsession. I check whether your API rejects it. Hobby locks the session at 7 days. Pro allows a custom lifetime.
The document shape is the sample pentest report. No client names.
What is not included for $2,400?
You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a Clerk dashboard audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.
Clerk says most vendor reviews can be answered from their SOC 2, and a custom questionnaire filled out by Clerk may require Enterprise. That letter is about Clerk. I do not rewrite your auth or test Clerk’s own infrastructure.
This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not read organization roles.
How does the review run from access to the PDF?
You authorize one URL, I use the test logins you send, and the clock starts when that login works. Clerk issues the session. Your API decides whether it believes the role. The PDF is what you keep. I do not patch production inside this price.
| Step | What happens |
|---|---|
| Trigger | Customer organizations are live, or a buyer asked whether one tenant can read another |
| Action | I walk the live UI as each test role and compare that session to the API those pages already call |
| System of record | The app, plus the written findings: severity, path, role, fix |
| Human escalation | You ticket the change. I do not edit production inside this price |
Send written authorization, at least one working test user, and a second user when two organizations or two roles must stay apart. Say what is public. Name the engineer who owns the API. One free retest of that same URL is included within 14 days.
When this isn’t the right move yet
Do not pay the $1,200 if I cannot legally open the app, or if a buyer named a certificate this offer does not include. Get a URL and two test users first. A pass with no login is a homepage skim.
I will not guess a Clerk app from a dashboard screenshot. Wait if nobody can create a member and an admin today. Hire the firm that holds CREST if the questionnaire requires that name. If the login is not Clerk, the same web application security review still covers auth and the API. A missed phone is the receptionist, $8,000 once, not this review.
What should be true before I start?
Bring the URL, two roles or two organizations, and one sentence on what is public. I can start without a tour of the Clerk dashboard. I cannot start without a login that behaves like production, or a public page becomes a false finding.
Before you pay, list what a member may see, what a signed-out visitor must still see, and confirm the Clerk secret key is server-only. If two organizations exist, write which records each one must never see. If you bought custom roles, name the role that should fail.
If you want the layout before credentials, ask for the sample from the contact form.
$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.
FAQ
How much does a Clerk security review cost? +
A Clerk security review cost is $2,400 once for one app, and $1,200 starts it. I review the live UI, Clerk login, organization roles, the session, and the API those pages already call. The report is written 48 hours after access works. You own the PDF. There is no monthly fee. A second app is a second quote.
Does Clerk Pro or the SOC 2 report replace this? +
No. Clerk Pro is $25 a month, or $20 a month billed annually, for the auth product. Business, $300 a month or $250 billed annually, is how you get Clerk's SOC 2 report. That letter describes Clerk. It does not show whether a member of one organization can open another organization's record in your API.
Do you need Clerk dashboard admin, and are exploit steps in the PDF? +
I need working test users, not your Clerk secret key and not dashboard admin. Two roles, or two organizations, when tenants must not see each other. The PDF has severity, path, role, and a fix. It does not include exploit steps, your credentials, or a certificate I do not hold.
When should I skip a Clerk review? +
Skip it if there is no URL I am authorized to use, or no test login. Skip it if a contract names CREST or a letter I do not hold. If the app does not use Clerk, the same $2,400 review still fits. Booking from an AI app and an invoice chase are different offers.
