Skip to content
SaaS · security review

A security review for SaaS that is still small enough to read.

For a SaaS app where customers log in and see their own data, the review is $2,400, or $1,200 to start. I look at the frontend, authentication, and API and write it up in 48 hours after I have access. It is not a header scan and not a compliance certificate.

The dangerous bugs in a young SaaS product are usually boring: one account can read another account's records, a password reset trusts the wrong id, or an admin route is only hidden in the interface.

See the security review Ask a question

$2,400 for one app, $1,200 to start. Written report in 48 hours after access.

Why founders book this

A customer or an investor asked

You need a written review from a person, not a badge from an automated scanner.

Tenant data is the product

If customer A can open customer B's invoice, nothing else on the roadmap matters that week.

The last audit was a spreadsheet

Someone exported a dependency list and called it a pentest. You want the request paths actually checked.

What I review

  1. Part 1

    Auth and session

    Login, reset, invite, and what a logged-out person can still call.

  2. Part 2

    Tenant boundaries

    Whether object ids in the API are checked against the caller's account.

  3. Part 3

    A written report

    Findings, severity, and what to fix. No exploit payloads. I do not name other clients.

Who this fits

A single web app with a real login, an API, and customer data. One product, not a holding company of six codebases.

What this is not

Grade your security headers

Questions

How much is a SaaS security review?

$2,400 for one web app. $1,200 starts it. The report is written within 48 hours after I have access, not after the first email.

Do you need production access?

I need a real environment and an account that can see the paths customers use. We agree the scope before anything starts. I do not scan the open internet and call it a review.

Will the report include exploit steps?

No. Findings are described so your developer can fix them, without a recipe someone else can run.

Also for this service

Michael Heredia

How would you like to talk?

Pick whatever is easiest. I read and answer every message myself.

Message me now Your note is already written; just hit send.
WhatsApp Text Email

+1 830-968-1575 · info@michaelheredia.com