#security-review
Operator notes filed under security-review — chronological, newest first.
tRPC security review cost: $2,400, not the hidden button
tRPC security review cost is $2,400 once for one app, $1,200 to start. You own the PDF. No subscription. The procedures the UI already calls.
Hasura permissions security review cost: $2,400 once
Hasura permissions security review cost is $2,400 once, $1,200 to start. You own the PDF. There is no subscription. Hasura role rules on Postgres.
WorkOS security review cost for trusting the SSO session
WorkOS security review cost is $2,400 once for one B2B app, $1,200 to start. You own the PDF. No subscription. The API must trust the SSO session.
S3 presigned URL security review cost, $2,400 once
S3 presigned URL security review cost is $2,400 once per app, $1,200 to start. You own the written report. No subscription. Due 48 hours after access.
Auth0 security review cost: $2,400, not the tenant bill
Auth0 security review cost is $2,400 once for one SaaS app, $1,200 to start. You own the PDF. No subscription. Checks the API audience. Own it.
Clerk security review cost: $2,400 once, you own it
Clerk security review cost is $2,400 once for one app, $1,200 to start. You own the report. No subscription. Org roles, session, and the API.
Firebase security rules review cost: $2,400, you own it
Firebase security rules review cost is $2,400 once for one app, $1,200 to start. You own the PDF. No subscription. Firestore and Storage rules.
Stripe webhook security review: the $2,400 checkout check
Stripe webhook security review of signature checks and who can read a Checkout Session. $2,400 once per app, $1,200 to start, no subscription.
Next.js security review cost: $2,400 once, one app
Next.js security review cost is $2,400 once for one app, $1,200 to start. You own the report. No subscription. Frontend, auth, and the routes the UI calls.
Supabase RLS security review: who can read the row
Supabase RLS security review is $2,400 once for one app. I check auth and the row policies the UI already trusts. You own the report. No subscription.