SAAS CODE AUDIT

FAQ #

• What does the audit report include?

  A severity-tagged findings document (Critical / High / Medium / Low) with a file:line reference, reproduction path, and recommended fix per issue. Every finding is actionable — the report functions as a sprint backlog, not a consulting summary.
• What’s the difference between the Discovery Phase and the full audit?

  The Discovery Phase audits one domain — tenant isolation and authentication — in 7 days. The Pilot Phase covers all six domains: security, N+1 queries, schema drift, architecture, secret management, and PII exposure across the full codebase.
• Do you fix the issues or only report them?

  We report and recommend. Remediation is a separate engagement — our Vibe Code Rescue or SaaS Development service. This separation keeps the audit objective: the auditor shouldn’t also bill to fix what they find.
• How do you handle multi-tenant isolation specifically?

  We trace every query path for customer_id enforcement — ORM calls, raw SQL, bulk operations, and background jobs. We map the IDOR risk surface: which endpoints accept IDs as parameters, which validate ownership, and which don’t.
• What makes this different from static analysis tools like SonarQube?

  Static analysis finds syntax-level vulnerabilities. We find architectural ones — a customer_id present but never validated, a race condition in a background job, a Zod field required but Optional in Pydantic. These require human judgment, not pattern matching.
• How is codebase access shared?

  Read-only GitHub repository access only. We never require write access or local setup. The codebase stays in your version control — we review from a branch off your main, and you revoke access after delivery.
• What have past audits found?

  customer_id enforced at model save but absent from query filters — background jobs bypassing tenant boundaries. Zod required fields mapped to Pydantic Optional with no default — null propagation on edge-case requests. OTP replay windows left open by missing rate limiting. Each delivered with file:line reference, reproduction path, and recommended fix.
• Do you sign NDAs?

  Yes. We sign NDAs before any codebase access is granted, on request.
• Who owns the audit report and findings?

  You do. The full findings document, severity matrix, and recommended fixes are fully assigned to you on completion — no vendor lock-in.
• Do you work with formal contracts?

  Yes. Signed contracts with fixed scope per phase. You’re contracting with a registered entity, not an individual.