Four areas, and the edge of each.

Your Postgres configuration, application source and live surface, re-examined on every pull request and on a fixed schedule.

• Row-level security posture per table, policy expressions that resolve to unconditional access, column-level grants held by browser-reachable roles, and the full set of Supabase advisor lints ingested rather than duplicated.
• Source analysis for committed and historical credentials, dependency advisories matched against your lockfile, injection and XSS sinks, and the stack-specific failure of a service-role client reachable from a client component.
• The deployed artefact itself: what your bundle ships, whether source maps are public, DNS authentication records, and whether your edge protection can be reached around.

We reconstruct the component under test in an isolated environment and attack it — never your production system.

• A throwaway arena is provisioned: either an ephemeral branch of your project carrying schema and policies but no data, or the specific table and its policies rebuilt on our own infrastructure. Two synthetic tenants are seeded into it.
• Authenticated as the first tenant, we attempt to read the second's rows. A control query runs first — if the arena cannot return the caller's own row, the run is discarded rather than reported as clean.
• Where the deterministic probe finds nothing, a reasoning agent proposes further queries. Its action space is constrained by a deterministic guard to read-only statements inside the disposable schema; every proposal, including refused ones, is recorded.

Application-layer abuse identified from your authentication events, and optionally turned away in the request.

• Credential stuffing distinguished by spread across accounts, brute force by concentration, and account takeover by the sequence of failures, success and password change from one source.
• Distributed floods assessed against your own traffic baseline rather than a fixed rate, and separated from legitimate growth by whether the surge is concentrated on one endpoint.
• Detection requires no installation — it reads the authentication log your database already writes. An optional edge module upgrades detection to enforcement, turning requests away before they reach your application.

Mechanical fixes are applied as a diff against your code. Everything requiring judgement is prepared, not performed.

• Where the correct output is determined entirely by the input — response headers, a build flag, a variable that should not carry a public prefix, workflow permissions — we open a pull request containing the edited file.
• Database changes are demonstrated before they are offered: the fix is applied in the arena, the attack re-run to confirm it now fails, and legitimate access re-run to confirm it still succeeds. A change that closes the attack by denying everyone is rejected.
• Findings close on evidence. When a subsequent pass no longer reproduces the condition, the finding is archived automatically rather than waiting for anyone to mark it done.

Terms of the engagement

$49 per month, billed monthly, with the first seven days free. Cancellation is self-serve from your dashboard and takes effect at the end of the current period — there is no cancellation fee, no notice period, and no requirement to contact us. Prepaid six- and twelve-month terms are one-time charges rather than auto-renewing subscriptions, and carry no early-termination fee.

Autonomous action is off by default and governed by a per-account switch you control. With it off, we observe and report; nothing is changed on your systems without you. Full terms are on the terms page, and what we store is described on the privacy page.