This is a track from the corporate development block. It comes in as the product grows from MVP to MMP and MLP. The track costs $4700.
Security is the thing most often postponed, because nobody sees it in a demo. You see it exactly once: when it is already too late.
For an owner this is about money and reputation, not technology. A leaked customer database, a manager exporting someone else's deals, a bot guessing passwords or a server with nothing to restore it from all cost more than any audit. An app security audit exists to find those holes before someone else does.
What is included
- Security audit.
- API protection.
- Roles and access rights.
- SSL, protection against attacks.
Security audit
We test the system the way an attacker would: which addresses are open, what can be done without logging in, what can be done under someone else's role, where secrets are stored and who can reach them. The result is a prioritised list of risks and a plan of fixes.
API protection
Every API method accepts only permitted requests from authorised users with the right role. Input is validated on the server, call frequency is limited, and error messages do not reveal how the system works inside.
Roles, SSL and attack protection
Rights are defined explicitly for every role and every action. All traffic goes over an encrypted connection, and common attacks such as password guessing, forged requests and code injection through forms are blocked on the server side.
A role limits actions, not appearance
The most common mistake in custom systems is hiding the button while leaving the action open. The check has to live on the server: every action needs an explicit list of roles and allowed methods, and operations that change data are accepted only through a protected request.
That is why client-side validation from the interface logic stage is there for the user's convenience, not for protection. The real restriction lives in the server-side business logic.
Production is not the same as test
Developer tools must be switched off in production, internal addresses closed, and the database included in the mandatory backup list with a tested restore. This is part of the infrastructure, but it is checked during the audit.
No system is completely secure. Security is a set of measures, restrictions and trade-offs, and if the business needs anti-bot, anti-spam or anti-scraping protection, or log auditing, these have to be written into the requirements and the budget explicitly.
What the business gets
- A prioritised list of the system's real risks, not a vague "everything seems protected".
- Rights enforced on the server: each role sees and does only what it should.
- An API that does not hand out data without authorisation and withstands brute-force attempts.
- A tested restore from backup.
Cost and what it depends on
The track costs a fixed $4700 and covers the audit, API protection, roles and access rights, SSL and attack protection. Before work starts, the consultation sets the boundaries: which data counts as sensitive, which roles exist in the system and which external integrations take part in data exchange.
If another team built the system and you first need to understand its state, the starting point is an audit of the existing system: $800 for a written report with findings and a list of risks, or $2400 with a reconstructed project picture and an early prototype of the change.
What breaks if you cut corners
- Customer data can be opened by a direct address without logging in.
- An employee with a basic role performs admin actions simply by sending a request that bypasses the interface.
- A former employee keeps access because roles are not revoked automatically.
- After a failure it turns out there is a backup, but nothing can be restored from it.
Examples from our work
The system for a network of medical centres has twelve roles. A role restricts pages and actions, while the link to a branch restricts which records are visible: a centre administrator does not see financial analytics, HR sees staff across the network but not patients or money, and a doctor does not see the P&L. The single source of truth about what each role can see is covered by an automated test, and working roles are revoked when someone leaves.
The Ingello MCP server is open to any AI agent without authorisation, so its API protection is built on a call limit for each tool. In Goal Decomposer the OpenAI key is kept in the user's browser and sent to the server only for the duration of a request; the server does not store it. The server itself has no external dependencies, leaving minimal surface for vulnerabilities.
Screen Recording Watcher for Android uses only standard permissions, with no hidden recording and not a single outgoing request carrying files. An app built like this passes a security team's review and creates no legal problems.
Where to go next
Related tracks: event-driven deepening and test automation. The map is in the app development strategy.
If your system holds personal, medical or financial data and nobody has checked its access rights, book a free consultation with an architect. We will go through the main risks, and after the consultation we will send a price and timeline broken down by stage.
