Services
Two ways to work with us: a scoped code review (the Bug Clinic), or a small, fixed-price piece of software work. Both start the same way — you tell us what you need, we agree the scope in writing, then we start.
The Bug Clinic
Priced per engagement, by scope — see pricing
Bring us code you own, or are authorized to submit, and we review it for logical bugs, hidden or undocumented behavior, and the kind of mistakes that pass code review but not production — unsafe patterns, hardcoded secrets, broken checks, and off-by-the-wrong-assumption logic.
- Intake. Tell us what you want reviewed and which methods you're comfortable with (static analysis, secret scanning, dependency checks, or manual review).
- Agreement. We send back a plain-text engagement naming the exact scope and methods. You confirm you own, or are authorized to submit, the material, and sign.
- Submission. You send the code as a zip archive. It's stored in an isolated workspace for this engagement only, and expires automatically after the review window.
- Review. We run only the methods your agreement lists. This is source-level analysis — we never execute your code or touch a running system.
- Report. Every finding is reviewed by a person before release. Secret values are redacted; you get the location, the risk, and a fix.
- Delivery. You receive the report. Either side can withdraw the engagement at any point, which deletes the submitted material immediately.
What we look for
- Hardcoded secrets and credentials that shouldn't be in source
- Unsafe patterns — dangerous eval/exec usage, shell injection risk, disabled TLS verification, string-built SQL
- Broken or missing authorization checks on sensitive actions
- Logic that works for the tested case but breaks on an untested assumption (off-by-one, inverted conditions, wrong defaults)
- Outdated or known-vulnerable dependencies
- Dead code paths and undocumented behavior that could surprise the next person who touches it
Small software engagements
Fixed-price, scoped up front — see pricing
Bug fixes, scripts, small integrations, test suites, and documentation — scoped and quoted before work starts, delivered for your review. Good for a well-defined piece of work with a clear "done" state; not a fit for open-ended or large, multi-month builds.
Start an engagement
Use the contact form or email us directly.