Ship-Ready Security Review

Your app was built fast.
Is it safe to ship?

A fixed-price security review of your agency-built or AI-built application. In five business days you get a ranked findings report, a fix list, and a signed, verifiable attestation you can show customers, investors and insurers.

Book a 20-min scoping call → Free exposure check

Prefer email? zilvinas@mrelabs.dev · See a sample attestation

Fixed price from €3,500
5 business days
Re-test included

SAMPLE · PAVYZDYS MRE LABS · RELEASE READINESS ATTESTATION MRE-ATT-2026-000 · issued 2026-11-03 Vėjas Rezervacijų sistema v2.3.1 Findings: found / remediated / open Critical 0/0/0 · High 0/0/0 · Medium 3/1/2 · Low 5/2/3 Status statement (1) At the retest date stated above, no Critical or High severity findings remained open within the stated scope. Medium and Low findings are documented in the Findings Report with a remediation plan. Read the full sample attestation ↓

Who it's for

You shipped quickly. Now someone is asking whether it's secure.

AGENCY-BUILT

Built by an agency or offshore team

You're about to go live, or just did, and nobody independent has looked at the code.

AI-BUILT

MVP built with AI tools

Cursor, Lovable, Replit or Copilot got you to paying customers. Now it has to hold up.

ASKED

Someone sent a questionnaire

An enterprise customer, an insurer, an investor or an acquirer wants evidence, not reassurance.

AGENCIES

You're the agency

Put an independent stamp on what you deliver. Partner terms available.

What you get

Not a scanner dump. A decision.

Every finding comes with evidence, a plain-language impact and a concrete fix. The attestation records scope, method, findings and retest status on one signed page your stakeholders can check and file.

See a sample findings report and attestation →

Findings reportEvery issue ranked Critical / High / Medium / Low with evidence (file and line), impact, and a fix with an effort estimate.
Fix listOrdered by what blocks go-live, what to fix within 30 days, and what goes to the backlog.
Walkthrough callWith your team or your agency, so the fixes get done right the first time.
Re-testOf Critical and High findings after you fix them, and a reissued attestation.
Release Readiness AttestationA one-page, signed and verifiable record of scope, method, findings by severity and retest status, which you can share with customers, investors and insurers and file as evidence of an independent review.

What I check

Tools find the known. I look for the logic.

Automated scanning covers dependencies, secrets and known patterns. Most of the time goes into manual review of the places where real breaches happen.

01Authentication & sessionsHashing, MFA, tokens, password reset, OAuth

02Authorization & tenant isolationCan customer A see customer B's data?

03Input handling & injectionSQL, SSRF, XSS, file uploads, path traversal

04Secrets & configurationFull git history, debug modes, CORS, headers

05Dependencies & supply chainKnown CVEs, CI/CD, containers, fake packages

06Infrastructure & deploymentCloud IAM, exposed databases, buckets, backups

07API & business logicPayments, webhooks, rate limits, race conditions

08AI/LLM featuresPrompt injection, tool permissions, data sent to vendors

09Data protection & privacyEncryption, PII in logs, retention, GDPR basics

10Operational readinessWho still has access, 2FA, incident contact

What I look for in AI-built and outsourced code

Authorization checked in one endpoint and forgotten in the one next to it
Validation in the UI only, while the API accepts anything
The same insecure pattern copy-pasted across modules
Packages that don't exist, were typosquatted, or were hallucinated by an AI tool
Tests that mock away authentication and assert nothing
// TODO: add auth, allowAll flags and hard-coded tenant IDs
Cloud accounts registered to a contractor's email, with ex-team keys still active

Published thresholds

Which status statement you get

Every attestation carries exactly one of three fixed statements. The thresholds that decide which one are public, so nobody has to take the wording on trust.

Statement (1)

Only Medium, Low or informational findings remain open. Documented with a remediation plan.

At the retest date stated above, no Critical or High severity findings remained open within the stated scope. Medium and Low findings are documented in the Findings Report with a remediation plan.

Statement (2)

No Critical findings. Open High findings have agreed fix dates within 30 days. Attestation reissued after re-test.

At the issue date, no Critical findings remained open within the stated scope. [N] High severity findings remained open; they are listed in the Findings Report with remediation scheduled by [date]. This attestation will be reissued after retest.

Statement (3)

Any open Critical, or three or more open High findings. Fix, re-test, then ship.

At the issue date, [N] Critical and [N] High severity findings remained open within the stated scope, including [one plain-language line for the most severe]. They are listed in the Findings Report.

Critical: exploitable now, leads to breach or takeover High: exploitable with preconditions Medium: weakens defences Low: best-practice gap

Sample attestation

What the attestation looks like.

A complete Release Readiness Attestation for a fictitious system and client. Real ones have the same structure, carry a real signature, and are listed at the verification address printed on them.

Download the sample PDF See its verification record →

SAMPLE · PAVYZDYS: fictitious system and client, for illustration

MRE Labs UAB "Megabonus" company code 300046310 Not VAT-registered Gyrio g. 5, LT-47200 Kaunas, Lithuania mrelabs.dev

Release Readiness Attestation

Attestation ID: MRE-ATT-2026-000
Date of issue: 2026-11-03

Issued to

UAB Pavyzdys, attn. Rūta Pavyzdienė, CEO

System reviewed

Vėjas Rezervacijų sistema v2.3.1 — vejas/booking-api, vejas/booking-web at commit a1b2c3d — staging

Scope

In scope: booking API (NestJS), web client (Next.js), PostgreSQL schema and migrations, staging configuration
Out of scope: production environment, payment provider integration, mobile app
Review package: Ship-Ready Review
Review period: 2026-10-20 – 2026-10-24 · Effort: 5 person-days
Retest: 2026-11-03 (Critical and High findings only)

Method

Automated static analysis, dependency and secrets scanning (Semgrep 1.x, Trivy 0.x, gitleaks 8.x); manual review of authentication, authorization, tenant isolation, input handling, data protection and configuration; infrastructure and CI/CD configuration review; Critical and High findings confirmed by single proof-of-concept requests on staging. Methodology reference: OWASP Web Security Testing Guide v4.2 / OWASP ASVS 4.0 level 2; MRE Labs review checklist v1. Full findings: Findings Report v1.0 dated 2026-10-24.

Findings at issue date

Severity	Found	Remediated and retested	Open
Critical	0	0	0
High	0	0	0
Medium	3	1	2
Low	5	2	3

Status statement

(1) At the retest date stated above, no Critical or High severity findings remained open within the stated scope. Medium and Low findings are documented in the Findings Report with a remediation plan.

How this document may be used

This attestation records that an independent review of the named system was carried out with the method and scope above, and the state of its findings at the dates stated. The client may provide it to customers, partners, insurers, investors and auditors for information, and may file it as evidence of an independent assessment under its own supplier-monitoring procedures (for Lithuanian cybersecurity entities: Government Resolution No. 818, points 34.4, 35 and 38). It is not a certification of compliance with any law or standard and does not replace a statutory audit.

Limitations

This document reflects the named version at the review and retest dates and the scope stated. It does not cover changes made afterwards, components outside the scope, or weaknesses not detectable with the method and time applied. It is a professional opinion on the findings of a time-boxed review, not a warranty or guarantee of security. Liability is as agreed in the engagement contract.

Reviewer

Zilvinas Binisevicius

Zilvinas Binisevicius, lead reviewer
[credential pending] · 30 years in software engineering and operations
UAB "Megabonus", company code 300046310, Not VAT-registered
Professional indemnity insurance: [policy pending]

Verify

mrelabs.dev/verify/MRE-ATT-2026-000 · PDF SHA-256: 972b896338447f12a4f8da52d65ea247fd3c6e355cfcbdf2f2617f326f7268e7

How it works

Five business days, start to signed attestation.

DAY 0

30-minute kickoff. You grant read-only repo and staging access and sign the NDA and testing authorisation.

DAY 1–3

Automated scans and manual review. Questions go through one shared channel.

DAY 4

Draft findings shared. You confirm or correct the context.

DAY 5

Final report, walkthrough call, signed attestation.

≤ DAY 30

You fix. I re-test Critical and High findings once and reissue the attestation.

What I need from you: read-only repository access including history, staging access for confirming findings (or a read-only configuration export if no staging exists), architecture notes or a 30-minute walkthrough, and one contact who answers within a business day. No production access required.

Packages

Fixed price. No surprises.

If the scope turns out larger than the package fits, you hear it on Day 1, with a quote, before any more work is done.

Ship-Ready Review

€3,500 excl. VAT

5 BUSINESS DAYS

One application, one repository, up to ~50k lines of code, one environment.

Static analysis, dependency & secrets scan
Manual review of auth, authorization, tenant isolation, input handling, data protection and configuration
Basic infrastructure & deployment config review
AI/LLM feature review, if present
30-day fix list
45-minute walkthrough call
Re-test of Critical/High within 30 days
Release Readiness Attestation

Book a scoping call or email about Ship-Ready

Platform Review

€7,500 excl. VAT

10 BUSINESS DAYS

2–4 services, up to ~200k lines of code, one cloud account.

Everything in Ship-Ready
Full infrastructure review: cloud IAM, network, CI/CD, containers, IaC
Threat model
Baseline dynamic testing on staging
Supply-chain review and SBOM
90-day remediation roadmap
Executive one-pager for stakeholders
60-minute walkthrough call

Book a scoping call or email about Platform

Due-Diligence Review

from €15,000

2–4 WEEKS · SCOPED

Any size. For acquirers, investors and boards.

Everything in Platform
Team & process assessment
Investor-grade roadmap with cost estimates
90-minute walkthrough plus acquirer Q&A session
Re-test within 60 days

Book a scoping call or email about Due-Diligence

50% on booking, 50% on delivery of the final report. Expedited start within 2 business days: +30%. Need the fixes done too? Remediation is quoted per findings bundle after the walkthrough.

FREE

Not ready for a full review?

Start with a free External Exposure Check.

I look at your product the way an attacker does on day one: from the outside, with no access to your code. You get a one-page summary of what's exposed and what to fix first.

TLS configuration and certificates
Security headers on your main pages
DNS and email records: SPF, DKIM, DMARC, CAA
Exposed admin panels, debug endpoints and backup files
Secrets and internal URLs in the JavaScript your site ships
Publicly visible software versions that are past end of life

One domain per company, results within 3 business days. Checks are non-intrusive: no login attempts, no exploitation, no load. I only scan a domain after you confirm you're authorised to request it.

Honest scope

What this is not.

A clear scope is what makes the attestation worth showing to someone.

Not a full penetration test. Ship-Ready includes no dynamic testing: findings come from the code and configuration. A Critical or High finding is at most confirmed with a single, non-destructive proof-of-concept request on staging, using test data, with no exploitation beyond showing the finding is real. Platform and Due-Diligence add baseline dynamic testing on staging, with no exploitation beyond proof of concept.
Not a compliance certification. ISO 27001, SOC 2, NIS2 and CRA gaps are flagged in the report; closing them is separate work.
Not a guarantee. The attestation is a point-in-time professional opinion on the named version and the stated scope.
Not a code-quality review, except where quality affects security.

Who reviews your code

I review the way an operator does.

I'm Zilvinas Binisevicius. I founded MRE Labs in Kaunas, Lithuania, and have run it for 10+ years. In total I've spent 30 years building and running production systems, including software for the nuclear sector and multi-tenant platforms serving business customers.

That background shapes how I review: what will actually be exploited, what will actually break, and what an auditor will actually ask. You work directly with me from kickoff to signed attestation, with no account managers and no hand-offs.

30 years in productionNuclear-sector softwareMulti-tenant SaaSEU AI Act · NIS2 · CRA awareEN · LT

FAQ

Questions people ask first.

Do you need access to production?

No. I work from read-only repository access and a staging environment that mirrors production. If there's no staging, a read-only configuration export works. Proof-of-concept testing never touches production data.

How is our code and data kept confidential?

An NDA is signed before kickoff. Everything I see is confidential, and the report and findings belong to you. Access is revoked at the end of the engagement.

Can our agency join the walkthrough and do the fixes?

Yes. The walkthrough is designed for whoever will do the fixes, whether that's your team or your agency. If you'd rather I do them, I quote a fixed price per findings bundle.

What if our app is bigger than the package?

You'll know on Day 1. I tell you what doesn't fit and quote the difference before continuing. No open-ended billing.

Can we share the attestation with customers and investors?

Yes. That's what it's for. It states the scope, the method, the findings by severity and the retest status for a named version at a specific date, so the reader knows exactly what it covers. Anyone you send it to can check it at the mrelabs.dev/verify/… address printed on it.

Does this make us NIS2 or CRA compliant?

No, but the report flags the compliance-relevant gaps it finds. If you need to get from those gaps to an evidence pack an auditor accepts, that's a separate readiness engagement.

What does the free exposure check involve?

An outside-in look at one domain: TLS, security headers, DNS and email records, exposed panels and files, secrets in the JavaScript your site ships, and visible software versions that are past end of life. Exactly what it does. It needs no access and nothing is installed. You get a one-page summary within 3 business days. It's not a substitute for a review, because most serious issues are only visible in the code.

Do you work in Lithuanian?

Yes. Reports and attestations are available in English or Lithuanian, with identical status statements.

Responsible disclosure

Found a vulnerability in this site?

Please email zilvinas@mrelabs.dev with the steps to reproduce. I'll acknowledge it within two business days and keep you updated until it's fixed. Please don't access other people's data, degrade the service or run automated scans at high volume. Good-faith research within these limits won't be pursued legally. Contact details are also in security.txt.

Book a review

Know before your customers, investors or attackers find out.

Book a 20-minute scoping call. Tell me what the product does, who built it, roughly how big it is and when you need the attestation, and I'll tell you which package fits and when I can start.