Frequently asked questions
Do I need to own the code I submit?
Yes — you must own it, or be authorized by its owner to submit it. We confirm this explicitly as part of every signed engagement, and we will not proceed without that confirmation.
Will you run or deploy my application?
No. Review is source-level only — static analysis, secret scanning, dependency checks, and manual reading of the code you submit. We never execute your application or connect to a live, running system as part of a review.
What happens to my code after the review?
It's stored in an isolated workspace created specifically for your engagement, and it expires automatically after the review window. You can withdraw the engagement at any time, which deletes the submitted material immediately.
Who sees the findings?
Only you. Every report is reviewed by a person before it's released, and it's never shared with anyone else.
How is this priced?
We quote each engagement individually based on scope, after intake and before any work begins. See Pricing for how we get to a number.
Can you test my live website or app directly?
Only with a properly documented, owner-activated authorization — the same standard we apply to any target, including our own. By default, engagements are source-level review of code you submit, not testing of a running system.
How do I start?
Use the contact form or email hello@mathcore.dev with what you'd like reviewed. We'll follow up with a scope and a quote before anything begins.