APPLICATION SECURITY REVIEW
Review your app.
Get a written fix list.
An independent review of your code, architecture, and AI features with Keith Myers. Get findings ranked by severity, with a recommended action for each.
- Authentication, secrets, data protection, and AI risks
- Reviews for established applications and apps built with AI coding tools
- Scope, access, and fee agreed before work begins
30 minutes · No charge · Opens CalendarBridge
WHO IT’S FOR
Before your app meets real users and real data.
- Teams shipping apps built quickly with AI coding tools such as Cursor, Claude Code, Lovable, or Replit.
- Software companies preparing for a client security review or due diligence.
- Products that handle personal, financial, or regulated data.
- AI features built on models, vector databases, agents, or third-party integrations.
WHAT I REVIEW
Six domains.
One consistent method.
Identity & access
Authentication on every endpoint, least privilege for integrations and service accounts, secrets handling, and vendor access to production.
Configuration & deployment
Production servers, exposed ports, network boundaries, container settings, and environment configuration.
Encryption
Encryption in transit between every service, encryption at rest, and field-level protection for sensitive data.
Data protection
Personal and regulated data across databases, vector stores, backups, and snapshots, with classification and retention.
Logging & audit
Centralized logging, database audit, and a tamper-resistant record of what the system and its AI components did.
AI-specific risks
Prompt injection, model tool permissions, data sent to model providers, and the human review around AI output.
02 / THE WORK YOU KEEP
A findings report
your engineers can use.
Each finding has a domain, a severity, and a recommended action. Critical items are the ones to close before production.
Directly exploitable today, or a regulatory blocker. Close before production.
A meaningful gap in defense, data protection, or compliance. Address promptly.
A strong recommendation for production readiness or best practice.
Minor configuration or housekeeping. Fix in the normal development cycle.
A question that needs an answer before the finding can be rated.
| # | Domain | Finding | Severity | Recommended action |
|---|---|---|---|---|
| 01 | IAM | API endpoints accept requests with no authentication. Network location is treated as trust. | Critical | Add authentication on every endpoint, deny by default, and log the user on each request. |
| 02 | IAM | Secrets and credentials committed to source control. | Critical | Move secrets to a managed secret store, rotate every value, and remove them from the repository. |
| 03 | Config | Development web server running in production. | Medium | Replace with a production-grade application server. |
| 04 | Data | Customer identifiers embedded into the vector database without redaction. | High | Redact or tokenize sensitive values before embedding. Treat embeddings as personal data. |
| 05 | AI | Untrusted user content can steer the model’s tool calls. | High | Constrain tools to named, parameterized operations and allow-listed data. |
| 06 | Open | Unable to confirm the main branch matches what is deployed. | Open | Confirm where production code lives before the findings are finalized. |
Illustrative sample based on common findings. No client details. A redacted sample report is available on request.
HOW IT WORKS
From repository access
to a clear fix list.
Agree the scope
A free 30-minute intro call to understand the application, its users, and its data. Agree access and scope.
Review the application
Read-only review of your repositories, architecture diagram, and documentation, plus a working session with your team.
Deliver the findings
A written report with every finding rated by severity, the assumptions behind it, and a recommended action.
Walk through the fixes
Review priorities with your engineers. Close the critical items first, then work through the rest.
A FEW USEFUL ANSWERS
Before we talk.
No. This is a review of your code, configuration, architecture, and documentation. If a penetration test is warranted, the report will recommend it.
DISCUSS YOUR APPLICATION
Agree the review scope
with Keith.
A free 30-minute call to discuss your app, its data, and the review.