LLMs ship the same bugs to everyone.
I find them on yours.
Vulnerability research and one-week hand-driven audits. Fixed price from $1,500. Refund if no High or Critical surfaces within 3 days.
2 CVEs
3 GHSAs
<7h patch SLA
100% credited
2× per month
Research log
- 2026-06-01 edgee HIGH EMBARGOED Trust-elevation in an AI gateway: one unanchored regex turned tool output into harness reminders
- 2026-05-22 postiz CRITHIGHMED JWT confused-deputy: one Skool cookie became SUPERADMIN on a social-scheduling SaaS →
- 2026-05-06 clicky CRITHIGH Unauthenticated RCE on an unsandboxed macOS AI assistant via SSE tool-call injection →
- 2026-05-04 outrank.so HIGH Supabase RLS quota bypass and unauthenticated Notion OAuth state forgery on an SEO SaaS →
- 2026-04-01 parakeetai HIGH EMBARGOED Coordinated disclosure on an AI interview assistant — writeup embargoed until August 2026
All writeups → · published after coordinated disclosure or a 7-day non-response window.
Thesis
Why AI-coded SaaS breaks differently
LLMs don't invent novel bugs — they repeat the same trust-boundary mistakes across every codebase they touch. The eight classes below show up over and over in the audits and writeups above.
- auth happy-path Middleware checks once; sibling route re-derives identity and forgets.
- jwt audience drift Tokens minted for one service accepted by another; claims read, not verified.
- tenant check missing Queries filter by
id, notorg_id. IDOR is the default. - rls drift Row-level security on the table the LLM remembered; off on the one it didn't.
- tool exec / eval User strings reach
exec,eval, shell, or string-built SQL via an agent tool. - agent ssrf Fetch-a-URL tools with no allowlist, hitting
169.254.169.254on demand. - hallucinated crypto Made-up APIs, made-up guarantees, made-up "secure by default" claims.
- trust-boundary leak Internal endpoints exposed by a deploy-config paste from a different repo.
Full taxonomy with detection recipes: the 12-class checklist →
Audits
Same lens, your codebase.
- Price
- From $1,500 fixed. No hourly.
- Finding promise
- High or Critical within 3 days, or full refund.
- Delivery
- Report + threat model + re-test by end of week.
- Capacity
- Two audits per month. Solo, hand-driven.
Get started
Send me your URL.
One sentence on what your app does. I'll reply with whether I see something worth a closer look. Free, no NDA needed at this stage.