Keystone. by Tech-Bharat
Security Audit · Available now

Find the security holes before someone else does.

Point the Security Audit at your GitHub repository. It reads your actual code across twelve security domains — the way an application-security engineer would — and hands back a report of exploitable weaknesses, each ranked P0–P3 with the exact file, who can abuse it, and how to fix it. Read-only: nothing is run or changed.

$399 per audit · one report, no subscription

If a run fails to produce a report, you're not charged. More in the FAQ.

Read-only 12 domains Ranked P0–P3 Every finding, a fix
Security Audit · what it checks

Twelve domains, nine focus areas. Only what's exploitable.

The audit works through twelve security domains, grouped below into nine focus areas. Every finding is grounded in a specific line of your code — who can trigger it, what they get, and the concrete fix. Style nitpicks are left out. Where the audit couldn't reach something, it says so rather than grading it clean.

Authentication

Who gets in

Missing auth on state-changing routes, weak session and token handling, password and token-replay flaws.

Authorization / IDOR

Whose data they reach

The big one: can user A read or change user B's records by swapping an id? Owner/tenant checks derived from the request instead of the logged-in identity.

Input & injection

Untrusted input to a sink

SQL/NoSQL/command/template injection, path traversal, and mass-assignment — request data reaching a dangerous operation unvalidated.

Output / XSS

Rendering attacker text

Reflected, stored, and DOM XSS, unescaped interpolation, dangerouslySetInnerHTML, and unsafe redirects.

Secrets

Keys in the code

Hardcoded keys, tokens and passwords — in the working tree and git history — plus secrets shipped in client bundles or written to logs.

Data protection

Sensitive data handling

PII in responses and logs, missing TLS enforcement, and weak or home-rolled cryptography.

Dependencies

Known-vulnerable libraries

Your dependency tree checked against public CVE data (OSV), assessed for whether your app actually reaches the vulnerable path.

Configuration

Exposure & misconfig

Exposed files, debug flags left on, permissive CORS, and missing or ineffective security headers.

Business logic & abuse

Workflow & resource flaws

Steps that can be skipped or replayed, price/quantity tampering, missing rate limits, and unbounded queries — plus observability gaps that hide an attack.

Security Audit · how it works

A repo in. A ranked report out. Nothing run.

STEP 01

Give it your repo

Enter your GitHub repository and where to send the report. The audit reads your code — it never executes, deploys, or modifies anything, and your clone is deleted the moment it finishes.

STEP 02

It profiles & reviews

It detects what your app is (API, SPA, GraphQL), grounds committed secrets and vulnerable dependencies, then reviews the code across all twelve domains for exploitable flaws.

STEP 03

You get the report

An executive summary for the founder and a P0–P3 technical list for whoever fixes it — each finding with its location, impact, and a concrete remediation.

Every finding, two ways

Readable by a founder. Actionable by a developer.

A real example of the kind of issue the audit surfaces — the risk in plain terms, and the concrete fix.

P0 · Critical

Any logged-in user can read any other user's invoices

In plain terms

The endpoint that returns an invoice trusts the invoice id in the URL and never checks who owns it. A customer who changes the number in /api/invoices/1042 to 1043 gets back someone else's invoice — name, amounts, and address. No special tools; just editing a URL.

The fix

Scope the query to the authenticated user — look the invoice up by both its id and the current user's id, and return 404 if it isn't theirs. The report cites the exact route and handler, and flags every sibling endpoint with the same pattern.

What this is — and isn't

An honest scope.

This is a static, read-only code review — a fast, thorough way to catch the classes of flaw that live in source: access-control gaps, injection, exposed secrets, and misconfiguration. It is not a penetration test: it doesn't run your application, probe a live deployment, or attempt exploits. Every report states exactly what was and wasn't examined, and app types it detected but can't yet assess are named — never quietly graded clean. Live, active testing against a running deployment is a separate engagement — ask us.

Know your exposure

Audit your codebase's security.

One flat price, one prioritized report you can hand straight to your team. Nothing on your systems is run or changed.