What you get: A security audit of your project done by humans using real tooling, not a one-shot LLM skim. We cover your smart contract, your backend, your frontend, your dependencies, and your live staging site. You get a written report with reproducible findings, severity ratings, and suggested fixes. What I check: Smart contract: Access control gaps, unchecked signers, missing PDA validation, arithmetic overflow, seed collisions, rent exemption bugs, state inconsistency across instructions, CPI misuse. Backend: Auth flow holes, token handling, SQL injection surfaces, IDOR, file upload risks, rate limiting, dependency CVEs. Frontend: Client-side secret leaks, XSS surfaces, auth token exposure, source map leaks, exposed dev routes. Live pentest (against your staging environment): OWASP Top 10, authentication bypass, privilege escalation, injection attempts, session handling. Runs both automated passes and manual verification. What you get back: A PDF report plus a markdown version your team can paste into issues. Every finding includes: Severity: Critical, High, Medium, Low, Info Location: file and line Reproduction steps Suggested fix Two rounds of fix review included. If something in the report is unclear, we jump on a call. What this is not: Not a rubber-stamp certificate. If we find things, we flag them. Every finding is yours to triage. Not a replacement for a Tier-1 audit firm on a billion-dollar contract. If you're handling nine figures on-chain, go to an actual cybersecurity company. Not an AI-generated PDF. Real people read your code and sign off before it goes to you. Turnaround: 10-14 days for standard scope. Rush available. How to order: Message before ordering with: Link to your repo (or a zipped snapshot if private) Your staging URL + auth credentials if gated Rough LOC breakdown (contract / backend / frontend) We'll confirm scope and a firm date before you commit.
2.50