Security first look

More is about to ride on your software: a bigger customer and their security questionnaire, a raise, a lot more users, or AI that acts on your customers' data. You don't know what a full security review would find or what it would cost, and I can't give you one fair price until I've read the code. So start small. I take a paid first look, at $150 an hour up to a cap we agree before I begin, and you find out what's serious so far and what the full job would take.

For example:

• Your app just took off, and you're not sure whether one user can reach another's data.
• A new business customer just sent you their security questions, and you'd rather know what's in your code before you answer them. I don't fill them in or certify anything.

You talk to the person doing the work: I'm Bryce Watson, and I do the look myself. I sign and date the notes and name the version of your code I read. They're my read of that version, not a guarantee.

I use AI coding tools to read faster (the main page's answer to "What happens to my code?" names them and says how I check their training settings are off), but I decide what goes in the notes and how serious it is. I spent more than a decade as a software engineer at eBay, and before that I worked on payments at hyperWALLET. See a sample report of how I read code.

1 When it's the right first step

• Your software is live, and a bigger customer, a security questionnaire, a raise or a lot more users is coming.
• It has teams or organizations with their own roles, more than one back end, or health, money, children's or other sensitive personal data.
• It has AI agents that read your users' data or act for them.
• You want to know what's serious before you commit to a bigger review or a round of fixes.

Not the fit: a small app about to launch. The $149 Launch Blocker Check is cheaper and faster for that, and if that's what you need, I'll tell you. Sent here by that check's list? The $149 comes off the first look if you book it within 14 days of the list.

2 What you get

• Written notes on what I read, anything serious I've found so far ranked by severity with steps to reproduce, and the full job's scope with an updated price range.
• What I didn't get to. A cap means I may not reach every part of a big system, so the notes say what I couldn't check and why.
• A call after the look, where we set the price of the full job: one fixed price, or capped hourly work, agreed before any further work starts.
• The notes are yours. You can stop after the first look and keep them, and you pay only for the hours of the look.

3 Where I start

Where serious problems tend to sit: whether one customer can reach another's data, sign-in and roles, server code that trusts whatever the browser sends, keys and secrets, how payments are confirmed, and, for AI products, what an agent can see and do and what a hostile message could make it do. With demo accounts, I test the riskiest of those paths, not just read them. How many I reach inside the cap depends on the size of your system, and the notes say which.

It's an engineering review, not a penetration test, compliance audit or certificate. I review the code, not your obligations under health, children's or payment rules.

4 How it works

1. Tell me what you're running and what's coming, with the form below. I reply within 2 business days.
2. If a first look fits, I send a short quote: the cap, the start date, the date you'll have the notes (counted from when I have access), what I'll need from you, and the full job as a range. You pay nothing before you've approved it.
3. You give me read access to the code and demo accounts (test logins, one for each kind of user) on a test copy with made-up data. I never need real customer records or live keys. No test copy yet? Say so, and the quote will include the simplest way to set one up, and whether any of it counts against the cap.
4. I bill my hours against the cap and stop when I reach it. I send one invoice with the notes, listing the hours worked.
5. You get the notes, and if you want the full job, we set its price on the call.

5 What I never do

• I never test your live app or touch real user data without your written OK.
• I don't run tests that flood your app with traffic or try to trick your staff (load, denial-of-service or social-engineering tests).
• I keep your code confidential, and within 7 days of the job ending I delete my copies of your code and data and tell you when it's done. The main page's questions explain what I keep and why.

6 Tell me about it

No payment and no access yet. Tell me what you're running and what's coming up, and I'll reply within 2 business days from bryce@watsonstandardco.com. Rather talk first? Book a free 15-minute call.

Don't paste keys, passwords or customer data into this form. It goes to my inbox through the Web3Forms relay, I use it only to reply, and I don't share it.