Pre-launch security review
Your coding agent can audit your code. It cannot be independent of the code it wrote, and it cannot be accountable for what ships. This is the human layer: someone reads your app before you launch it, writes down what is wrong and how to fix it, and puts their name on the result.
The automated check is free and always will be. Run /seatbelt as often as you like. This page is for the moment when free is not enough, because real users are about to arrive, or because a client is about to accept the work.
Who this is for
- You are about to launch something real. There are accounts, payments, or other people's data behind it, and you would like someone who does this to look before strangers do.
- You are handing work to a client. You want a written check attached to the handoff, so "is it secure" has an answer that is not just your word.
What you get
Pre-launch review, $250
- A full pass over the seven surfaces: code execution, login, payments, secrets, customer data, databases, risky shortcuts.
- Automated detection plus a human reading the parts a scanner cannot reason about, mainly authorization: whether each route actually belongs to the person calling it.
- A written report, ranked by severity, with the exact file and line, what an attacker could do, and the fix.
- A re-check after you fix, so the report ends with what is actually true rather than what was true on day one.
- Three business days. One round of follow up questions after you read it.
$250. The work is the same either way. Early ones are cheaper because you are taking a chance on a reviewer with a short public record, and that should cost you less.
Handoff package, $1,500
- Everything in the review, plus:
- A short client-facing summary you can attach to a handoff, written to be read by someone who does not read code.
- A signed attestation of what was checked, when, and by whom.
- Five business days.
What the report carries
An audit is only worth what someone else can verify. Four things make this one hold up when a client, an investor, or an acquirer reads it.
- Every finding mapped to a published standard. OWASP Top 10 and a CWE identifier on each issue, plus a coverage table against the OWASP Top 10 for Agentic Applications and AIUC-1 for AI-built software. Your client does not have to take our word for what counts as a real problem, because we did not invent the list.
- A named reviewer. A person signs the report, with credentials, and is answerable for it. That is the part a model cannot do.
- Re-runnable evidence. The automated half is a deterministic engine, so anyone can run the same check and get the same result. Most audit reports are a PDF you have to trust. This one comes with a live link and a method you can repeat.
- A published method. What gets checked, and how, is written down and public. A black box asks for faith; a stated method invites scrutiny and survives it.
Scope
Stated precisely, the way an audit should be, so the report says something exact rather than something vague.
- Covered: application source and configuration across the seven surfaces, assessed against the standards above.
- Static and analytical. Findings come from reading the code and reasoning about it. No live exploitation is performed, so this complements a penetration test rather than replacing one.
- Application layer. Cloud account posture, DNS, and network configuration sit outside this review and can be scoped separately.
- Compliance. Findings map to the control families that SOC 2 and HIPAA readiness work draws on, which is the groundwork those programmes start from. Certification itself is issued by a licensed auditor, and we will tell you plainly which parts of that path this does and does not cover.
How it works
- Email with a sentence about the app and what it handles.
- You get a scope and a fixed price back, or an honest no if it is not a fit.
- You share the repo, or a zip if you would rather not add access.
- The report lands in three to five business days.
Capacity is two reviews a week, because it is one person doing them properly rather than a queue.
Start
Email hello@withseatbelt.com with what you are shipping. If you have never run the check at all, start there: scan your app. It reads what is in front of it today. A review is for the questions a scanner cannot answer, mainly whether each route belongs to the person calling it, so a clear scan is a reason to book one with less to fix, not a reason to skip it.