AI-product startups
You are shipping an LLM feature or an agent
A small engineering team selling to businesses that will ask security questions. You need a senior review before the customer's questionnaire arrives.
Security review for AI-built software
A senior engineer reviews what your AI wrote.
AI wrote it fast; we check it carefully. The Launch Security Check is a fixed-price security review of an app built with Cursor, Lovable, Bolt, Replit or Claude Code, with findings ranked by real exploitability.
- Launch Security Check
- from US$790 fixed once scope is confirmed
- Report delivered
- within two business days of confirmed scope, payment and access
- You get
- Report + 30-min walkthrough
Book a scoping call
Opens an email to hello@proofmerge.com
Finding formatIllustrative example
HIGH
Table
Table profiles is readable without a session
- Where
public.profiles, row level security disabled- Impact
- Anyone holding the public anon key can read every row.
- Fix
- Enable RLS and restrict reads to the owning user.
+ alter table public.profiles enable row level security;
+ create policy "own row" on public.profiles
+ for select using (auth.uid() = id);Who it is for
Teams that ship faster than anyone can review
The code works. Nobody senior has checked the secrets, the authentication, the database rules, the exposed APIs or the dependencies.
Founders and solo builders
You built the product with AI tools
Cursor, Lovable, Bolt, Replit or Claude Code got you to a working app. You want to know what is exposed before real users and real data arrive.
Software agencies
You build AI apps and MVPs for clients
You need a security partner to review a build before handover, under your brand if you prefer, or to help answer a client's security questionnaire.
What gets checked
Five areas we check in every AI-built app
Automated scanning does the first pass. The ranking and the conclusions are human: each finding states where it is, what an attacker could do with it, and how to fix it.
Secrets
API keys, tokens and credentials in the repository, its history, or the code shipped to the browser.
Authentication
Sign-in, sessions and authorization: who can reach which route and which record.
Database rules
Access rules on your data, for example Supabase row level security policies.
API exposure
Endpoints that answer without the checks the interface assumes are there.
Dependencies
Third-party packages with known vulnerabilities, and what they mean for your app.
We say what was reviewed and what was not. A clean report means we found nothing in the agreed scope; it does not mean the product is secure.
Offers
Fixed scope, fixed price, in US dollars
Start with the check. Step up only if the findings or your product call for it.
-
Start here
Launch Security Check
For apps built with Cursor, Lovable, Bolt, Replit or Claude Code. Secrets, authentication, database rules, API exposure and dependencies. Report plus a 30-minute walkthrough.
from US$790 fixed once scope is confirmed · report within two business days of confirmed scope, agreed payment arrangements and complete access
-
LLM features and agents
AI Agent & LLM Security Sprint
Prompt injection, data leakage, agent and tool permissions, MCP integrations. Mapped to the OWASP Top 10 for LLM applications.
US$1,900–4,500 agent or MCP sprint to full application · 2–7 days
-
We fix it
Fix Sprint
We remediate the findings and install a CI/CD security pipeline (SAST, secrets, SCA and IaC scanning) so they stay fixed.
from US$1,500 2–5 days
-
Infrastructure
Cloud & CI/CD Security Assessment
Review of AWS, GCP or Azure together with GitHub or GitLab, delivered as a prioritized remediation plan.
US$2,400 3–5 days
Prices are the current launch offer, in USD, for the scope agreed in writing before work starts. US$790 covers one small application; larger or multi-service codebases are quoted after the scoping call.
Services
Beyond the security check
The same engineering, applied to building and running software. Scoped per project after a short call.
Launch Security Check
Independent, human-reviewed security assessment before production launch. From US$790 for a confirmed small-app scope.
AI Automation & Workflow Development
Agents and automations that connect your tools and remove manual steps, built with access controls and logging from the start.
DevSecOps & Cloud Security Consulting
CI/CD pipelines with security checks built in, cloud configuration reviews on AWS, GCP or Azure, and hands-on remediation.
Tools & Templates
Coming later: downloadable checklists and automation templates from our own delivery work. Nothing is on sale yet.
Automation and consulting work is quoted per project. Write to hello@proofmerge.com with what you want to build or review.
How it works
Four steps, no surprises
Scope and NDA
A short call to agree what is in scope and what is not. We sign an NDA and you authorize the review in writing before anything is shared.
Read-only access
You grant read-only access to the repository and the relevant configuration. You control the access and remove it when the work is done.
Review
Automated scanning runs first. A senior engineer then reads the code and configuration, confirms what is real, and ranks it by exploitability.
Report and walkthrough
You receive the written report, then we go through it together on a 30-minute call so your team knows what to fix first.
The Launch Security Check report is delivered within two business days of confirmed scope, agreed payment arrangements and complete access.
What the report looks like
Not a scanner dump
A short document your engineers can act on the same day.
- Ranked by real exploitability. What an attacker can actually reach comes first.
- Specific. File, table or endpoint, the impact, and the fix.
- Honest about scope. A list of what was reviewed and what was not.
report structure
- Summary and scope01
- Findings, ranked02
- Evidence and impact03
- Recommended fixes04
- Reviewed / not reviewed05
About
Senior engineering, start to finish
Proofmerge is an independent security and engineering practice led by a senior DevSecOps and security engineer. We read AI-generated code as both the engineer who has to ship it and the reviewer who has to find what is wrong with it.
Every review is done by a senior engineer personally. There is no hand-off to a junior team and no report assembled from tool output alone. Proofmerge is a small practice, not a large firm, and holds no certifications to sell you.
- 4+ years across software development, security and DevOps
- Based in Da Nang, Vietnam
- Works remotely, in English
FAQ
Questions a CTO asks first
What access do you need, and how is it kept confidential?
Read-only access to the repository and to the configuration in scope, such as database access rules. We do not ask for write access for a review.
An NDA is signed before you share anything, and work starts only after you authorize it in writing. You grant the access yourself and remove it once the report is delivered.
Is this a penetration test or a certification?
No. It is a security review of your code and configuration, done with access you grant. It is not a penetration test, and it is not a certification or an audit opinion.
We do not issue SOC 2 reports or ISO 27001 certificates. The report describes what we found in the agreed scope at the time of the review.
What is in scope, and what if my app does not fit?
The Launch Security Check covers one application: secrets, authentication, database rules, API exposure and dependencies. Scope is agreed in writing after the scoping call, in the statement of work, before any invoice.
If your product is larger or runs LLM features and agents, we will say so on the call and point you to the right step of the ladder instead of stretching the check.
How do I pay?
By invoice, in US dollars. The price is fixed for the agreed scope, and payment terms are set out in the statement of work you sign before work starts. There is no checkout on this site and we never ask for card details by email.
Can you fix what you find?
Yes, as a separate Fix Sprint from US$1,500. We remediate the findings and install a CI/CD security pipeline so the same issues are caught before the next merge.
Proof before you merge
Fixed price. Report within two business days of confirmed scope, agreed payment arrangements and complete access. Findings ranked by real exploitability.
Tell us what you built and what it was built with. We reply with times for a short scoping call.
No mail app? Write to hello@proofmerge.com