tRPC security review cost: $2,400, not the hidden button
tRPC security review cost is $2,400 once for one app, $1,200 to start. You own the PDF. No subscription. The procedures the UI already calls.
In this article· 6 sections
A tRPC security review cost is $2,400 once for one application. $1,200 starts the work. The other $1,200 is due when the report is delivered, 48 hours after I can sign in. You own the PDF. There is no subscription.
That price is for a founder or an engineering lead whose browser talks to the server through tRPC. A procedure is a function the client can call. Hiding the button does not close it. I cover the live UI, login, and the procedures those screens already call.
Short answer: The tRPC security review cost is $2,400 once, with $1,200 to start, for one app. I review the live UI, auth, and the procedures that UI already calls, and I write the report 48 hours after access works. You own it. A scanner PDF and a multi-week letterhead engagement are different products. The offer lives on the web application security review page.
What does a tRPC security review cost?
$2,400 once for one app that uses tRPC, $1,200 to start, the rest on delivery. You are not buying a monthly scan, a source-code audit, or a stamp I do not hold.
WardenBit’s 2026 small-business guide puts most web app projects between $2,500 and $15,000, and the $100–$3,000 band as mostly automated scanning. Their single-target plan is $2,500 per engagement, with one retest once access is ready. Budget Security’s 2026 table lists a web application at $4,000 to $20,000. Their day rate is $985, so five days is $4,925, report and one retest included.
| What you are buying | 2026 price | What you actually get |
|---|---|---|
| Mostly automated scan | $100–$3,000 | Tool output, thin human judgment |
| This tRPC review | $2,400 once, $1,200 to start | One app, live UI, auth, the procedures the UI already calls, report in 48 hours, one retest |
| WardenBit, one target | $2,500 per engagement | Their published one-target plan and one retest |
| Budget Security, five tester-days | $4,925 | Their published $985 day rate times five, report and one retest |
If you bought a $4,925 engagement once a year, two years is $9,850 and three years is $14,775. This review is $2,400 once. A second app, or procedures you ship after the retest window, is a new quote. I am not renting you a seat.
The same $2,400 figure is on pricing.
What does that $2,400 actually open?
I sign in as the role you grant and walk one live app: the pages, the forms, and the tRPC queries and mutations those screens already call. I do not start from a procedure list I invented.
Checklist I run on one URL:
- A page that still renders for the wrong role, or for nobody signed in
- A query the screen already runs, called again as a user who should not see that record
- A mutation the button already fires, with the same question
- A procedure that only checks that someone is logged in, then returns another account’s row
- An id the UI already sends that belongs to someone else
I do not paste a recipe into the PDF. Procedure name, role, severity, fix. The shape of that document is the sample pentest report. If the product is a plain HTTP API with no tRPC, read API security review first. This page is the procedure case.
Where should a tRPC procedure check live?
The check belongs on the procedure, not only on the page that hides the button. Logged in is not the same as allowed to touch that record. A parsed header is not that decision.
The authorization guide shows a public procedure as open to anyone, and a protected one that throws when ctx.user is missing. Context is built per request, often from a header. A header that parses is not a decision about which row that person may read.
The procedures guide then splits “logged in” from “a member of this organization.” The second failure they show is forbidden, not a missing session. Checking the shape of the input does not answer either question. I grade the live procedure.
I will not write a bypass into the report. If a public procedure returns private data, the finding is the missing check and the fix.
What is left out of the price?
A source audit, a Hasura permissions pass, an S3 link review, mobile binaries, a cloud account, phishing, a second hostname, and any procurement letter are left out. You are buying one URL, once, with no monthly fee.
Not included:
- Reading the repository or a monorepo as the product
- Admin rights inside an identity vendor
- Database rules, storage rules, or a bucket policy
- Infrastructure, containers, or a firewall review
- A CREST, PCI, or SOC report I am not certified to sign
- Exploit steps someone else could copy
- Procedures you add after the free retest
This is not Workflow Automation and it is not AI Front Door. I am not copying a payroll journal into QuickBooks, and I am not letting a customer book from Claude or ChatGPT. Those are other offers.
How does the pass run?
Written permission plus a login that works is the trigger. The action is the walk of that one app. The PDF is the system of record. You fix, then I retest the same URL once.
- You name one production or staging URL, say what is out of scope, and authorize it in writing.
- You send a user who can sign in. A second role makes the checks sharper. I can still run one role and write that limit down.
- I exercise the pages and the procedures they already call, then put test state back.
- You get severity, procedure, role, and a remediation an engineer can ticket. The clock for that PDF is the 48 hour security review: it starts when login works.
- You fix. I retest that same URL once, free, within 14 days.
If you want the document before credentials, ask for the sample from the contact form.
When this isn’t the right move yet
Wait if there is no login, you cannot authorize the URL, or you need a stamp instead of a ticket list. A marketing site is too early. So is buying this when the leak is a weekly ops job or a booking path inside an AI app.
Wait if any of these are true.
- The site has no accounts, and the procedures only return public copy.
- Login is still a mock.
- You cannot name a person who owns the URL.
- A customer contract requires a certification I do not hold.
- You wanted the invoice chase, or a booking path inside Claude, ChatGPT, or Grok. Different page, different price.
- The browser calls Hasura, database rules, or a signed file link, and tRPC is not on that URL.
Buy it when one app’s browser calls tRPC, real users have accounts, you can grant a test user, and someone on the team will read a ranked list this week.
$1,200 reserves the work on the review page. I confirm scope in writing before I start. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.
FAQ
How much does a tRPC security review cost? +
One tRPC application is $2,400 once. $1,200 starts the work and $1,200 is due when the report is delivered. You own the PDF. There is no monthly fee. A second app, a mobile client, or a source-code audit is a separate quote. Public small-app quotes still cluster from about $2,500 to $15,000.
Is hiding the button enough to protect a tRPC procedure? +
No. A tRPC procedure is a function the client can call. The official docs treat a public procedure as open to anyone, and they show middleware that throws when there is no user. I test the procedure the screen already calls, as the wrong user. A hidden button is not the control.
How fast is the written report? +
The report is due 48 hours after access works. The clock starts when I can sign in on the URL you named, not when the invoice goes out. One free retest of that same URL is included within 14 days. The PDF has severity, procedure, role, and a fix. It does not include exploit steps or your credentials.
Do I need to send the GitHub repo? +
No. I review the running app: pages, auth, and the procedures the UI already calls. Reading the repository is a different job and a different price. Tell me whether calls sit on a public procedure or an auth middleware, and give me a working test user. That is the access I actually need.
