Pre-launch security review

Your coding agent can audit your code. It cannot be independent of the code it wrote, and it cannot be accountable for what ships. This is the human layer: someone reads your app before you launch it, writes down what is wrong and how to fix it, and puts their name on the result.

The automated check is free and always will be. Run /seatbelt as often as you like. This page is for the moment when free is not enough, because real users are about to arrive, or because a client is about to accept the work.

Who this is for

• You are about to launch something real. There are accounts, payments, or other people's data behind it, and you would like someone who does this to look before strangers do.
• You are handing work to a client. You want a written check attached to the handoff, so "is it secure" has an answer that is not just your word.

What you get

Pre-launch review, $500

• A full pass over the six surfaces: login, payments, secrets, customer data, databases, risky shortcuts.
• Automated detection plus a human reading the parts a scanner cannot reason about, mainly authorization: whether each route actually belongs to the person calling it.
• A written report, ranked by severity, with the exact file and line, what an attacker could do, and the fix.
• Three business days. One round of follow up questions after you read it.

Handoff package, $1,500

• Everything in the review, plus:
• A re-check after you fix, so the report ends with what is actually true rather than what was true on day one.
• A short client-facing summary you can attach to a handoff, written to be read by someone who does not read code.
• A signed attestation of what was checked, when, and by whom.
• Five business days.

What the report carries

An audit is only worth what someone else can verify. Four things make this one hold up when a client, an investor, or an acquirer reads it.

• Every finding mapped to a published standard. OWASP Top 10 and a CWE identifier on each issue, plus a coverage table against the OWASP Top 10 for Agentic Applications and AIUC-1 for AI-built software. Your client does not have to take our word for what counts as a real problem, because we did not invent the list.
• A named reviewer. A person signs the report, with credentials, and is answerable for it. That is the part a model cannot do.
• Re-runnable evidence. The automated half is a deterministic engine, so anyone can run the same check and get the same result. Most audit reports are a PDF you have to trust. This one comes with a live link and a method you can repeat.
• A published method. What gets checked, and how, is written down and public. A black box asks for faith; a stated method invites scrutiny and survives it.

Scope

Stated precisely, the way an audit should be, so the report says something exact rather than something vague.

• Covered: application source and configuration across the six surfaces, assessed against the standards above.
• Static and analytical. Findings come from reading the code and reasoning about it. No live exploitation is performed, so this complements a penetration test rather than replacing one.
• Application layer. Cloud account posture, DNS, and network configuration sit outside this review and can be scoped separately.
• Compliance. Findings map to the control families that SOC 2 and HIPAA readiness work draws on, which is the groundwork those programmes start from. Certification itself is issued by a licensed auditor, and we will tell you plainly which parts of that path this does and does not cover.

How it works

1. Email with a sentence about the app and what it handles.
2. You get a scope and a fixed price back, or an honest no if it is not a fit.
3. You share the repo, or a zip if you would rather not add access.
4. The report lands in three to five business days.

Capacity is two reviews a week, because it is one person doing them properly rather than a queue.

Start

Email hello@withseatbelt.com with what you are shipping. If you have not run the free check yet, start there: scan your app. Plenty of apps come back clear, and then you have saved yourself the money.