Identity is not authorization
A valid login does not prove the user may perform the requested action or read the requested record.
Specialist engineering audit · fixed scope
Prove who can access which data—and why.
A focused review of authentication, authorization, tenant isolation, RLS, secrets, APIs, webhooks, dependencies, and storage permissions.
No mandatory callSenior-reviewedDeveloper-ready output
3–5 daysTypical review
Named seniorAccountable owner
EvidenceDeveloper-ready
AccessRead-only first
The decision before delivery
Generic reviews miss the risk inside the workflow.
A specialist audit follows the real domain and production paths instead of applying a generic checklist.
Application checks are not enough
Tenant isolation must survive alternate API paths, direct identifiers, background jobs, and database access.
Trust enters through integrations
Webhooks, storage, service roles, secrets, and dependencies can bypass otherwise sound UI controls.
Exact output
A specialist report with a bounded next step.
Findings explain exposure, evidence, remediation, acceptance criteria, dependencies, and effort.
Trust-boundary map
Users, roles, organisations, service identities, storage, and integrations mapped together.
Auth and authorization findings
Route, action, object, and field-level access evidence.
Tenant and RLS verification
Cross-account tests and database-policy review.
Secrets and dependency review
Exposure, scope, rotation, and exploitable package risk.
Webhook and API integrity
Signature, idempotency, replay, rate, and validation controls.
Patch guidance
Recommended changes, sample diffs where appropriate, and acceptance tests.
How the work happens
Go deeper where the business can actually fail.
The method adapts to the audit domain while preserving the same evidence and accountability standard.
01Map identities and trust boundaries
Document users, roles, tenants, service accounts, data stores, and external integrations.
DAY 0102Test authorization and isolation
Trace object access, RLS, storage, administrative paths, and cross-tenant behavior.
DAY 0203Review API and integration integrity
Check secrets, dependencies, input, webhooks, replay, rate limiting, and failure handling.
DAY 0304Deliver closure plan
Rank findings, recommend patches, define acceptance evidence, and sign the decision.
FINALAn honest boundary
Know when this is—and is not—the right product.
Qualification protects both teams and prevents a compact review from being sold as certification, incident response, or an enterprise programme.
RIGHT FIT
Use this audit when the specialist risk is material.
- Multi-tenant SaaS or marketplace
- Enterprise customer security review is approaching
- AI-built auth or Supabase RLS needs independent evidence
- Payments, webhooks, or storage cross a trust boundary
NOT THIS PRODUCT
Use a different qualified path when the need exceeds scope.
- Active breach or incident response
- Formal penetration test
- SOC 2, HIPAA, PCI, or legal certification
- Very large estate requiring a multi-team programme
Code, access, and accountability
Your code stays yours.
Read-only first
Access starts at the minimum level required to establish evidence.
NDA available
Confidentiality can be agreed before repository access is granted.
Access removed
External access is revoked at delivery or at the agreed audit-window end.
Named senior review
Automation collects evidence; a senior engineer owns and signs the decision.
Connected resources
Use the smallest useful next step.
Free tools reduce uncertainty before purchase. Service and lane links explain what happens when implementation is required.
Straight answers
Before access is granted.
Is a call required?
No. The direct audit path is designed to begin from a short intake, approved access, and checkout. A conversation remains available as a separate option.
Will Zenveus make changes during the review?
Not unless the product explicitly includes a repair sprint. Reviews begin read-only and separate findings from implementation.
Can our own team use the report?
Yes. Findings are written with evidence, remediation, acceptance criteria, and effort so another qualified team can implement them.
Is this certification or a penetration test?
No. Engineering readiness can prepare a product for specialist review, but it does not replace legal advice, certification, or a formal penetration test.
Start without a meeting
Send the minimum we need to begin.
This review form is ready for the secure checkout and repository-access integration. The page remains a draft until those commercial systems are connected.
The next decision
Make the specialist risk visible and fixable.
Start from evidence, receive a written decision, and choose implementation only after the scope is clear.