01 The 48-hour audit
Pay. Send the repo. Know where you stand in 48 hours.
No call, no scoping meeting, no "let's chat". Just a written, severity-ranked report on the five things that break vibe-coded apps, with a fixed quote to fix what's dangerous. Late? Then it's free.
After paying you'll get a personal confirmation from us, usually within a few hours and always the same working day. The 48-hour clock starts at that confirmation, not while you sleep.
Card works inside the PayPal checkout, no PayPal account needed (Stripe isn't available to Indian companies yet). Prefer an invoice, or questions first? Write to us.
Already leaked something, or a key is exposed right now? Say so here. Leaks get triaged before anything else: tell us what leaked and when, we reply within 4 hours on working days, and we start with containment, not the checklist.
02 How it works
Three steps, one clock.
Pay the fixed €299
Checkout via PayPal. Card works too, no account needed. Credited in full if you hire us for the fix.
€299Send us access
Reply to the receipt or use the contact form: repo URL (read-only invite to GitHub user etherlabz is fine), the deployed URL, and one line on what worries you. We confirm receipt, and that confirmation starts the 48-hour clock. NDA on request before you share anything.
~10 minReport in 48 hours
A written, severity-ranked report on the five failure modes (auth & access control, payments, secrets, error handling, monitoring) with a fixed quote to fix. Yours to keep either way. If the report is late, the audit is free.
48 h- H+0: Payment confirmed. The clock starts
- You get a personal confirmation and send read-only repo access plus one line on what worries you. NDA on request before you share anything.
- H+8: Secrets & git-history scan logged
- Exposed keys, service roles in client code, credentials in git history: found, logged, and (if leaking right now) flagged to you immediately.
- H+16: Auth & access-control pass complete
- Row-level security, server-side checks, session handling. Can a stranger read another user’s data by changing a parameter? We find out.
- H+24: Payments & error handling checked
- Does the Stripe flow actually charge, is the webhook verified, and what happens on the unhappy path? Logged with severity.
- H+36: Monitoring reviewed, findings ranked
- Environments, logging, alerting. Every finding is ranked by severity so you know what’s dangerous versus cosmetic.
- H+48: Report + fixed quote delivered
- A written, severity-ranked report with a fixed quote to fix. Late? The audit is free. Yours to keep either way.
§ Chain of custody
Your code is handled like evidence
NDA by default on request. Read-only repository access is enough. Any secret we touch gets rotated before handback. Stacks we live in: Next.js, Supabase (including row-level security), Stripe, Vercel, Firebase, Node. See exactly what the report looks like before you pay.
03 Who you're paying
Named humans, checkable work.
Mradul Tripathi (engineering) and Sanya Madre (design). The founders do the audits themselves, no outsourcing: Mradul runs the security and engineering side, Sanya runs the UI/UX audits. We run our own production auth and billing every day: ReliPay is our MIT-licensed auth & billing product, and you can read the code before you trust us. Etherlabz IT Solutions Pvt. Ltd., registered in India, working with founders across the EU and US.
“Communication was clear, consistent, and highly responsive, making collaboration smooth and efficient. … Their team consistently demonstrated professionalism, adaptability, and a genuine commitment.”
Kristjan Idrizi · Founder & CEO · ★ Verified 5.0 review on Clutch
Not ready to pay? Read the sample report or the rescue overview. Prefer a human first? Book a 30-minute call.