Codeneath Review
Codebase reviews and hardening for AI-built apps
Answers to six plain questions, each pinned to the exact file and line, with a fix for every finding. From $499, in about 5 working days.
CriticalQ2 · Is it secure?
app/actions/projects.ts:17
Any signed-in user can delete any organization's project by sending its id.
Scope the delete to the session's orgId and return 404 when no row matches. Add a test: a user from another organization gets 404.
- Severity, and the question it answers
- The exact file and line
- What it means for your users
- A fix prompt for your AI tool
Evidence, not alerts
Alert-list scanner
Pattern warnings in a long list. You work out which ones matter.
Codeneath Review
Verified findings, most serious first, each with its fix.
CriticalQ2 · Is it secure?lib/db.ts:3
− export const db = createClient(url,− process.env.NEXT_PUBLIC_SERVICE_KEY);+ export const db = createClient(url,+ process.env.NEXT_PUBLIC_ANON_KEY);+ // row-level security on every table,+ // and rotate the service key that shipped- Fix prompt for your AI tool
- Checked by hand at file:line
Inside a Codeneath Review report
An example report on an illustrative app. Pick a finding, then open each part.
- InputAny signed-in user
projectId of another company - Server Action
app/actions/projects.ts:17Checks sign-in, not ownership - Impact · projects tableAnother customer's project deleted
deleteProject("prj_acme_42") # signed in at other.co200 acme’s project is gone
CriticalCWE-639 · IDORQ2 · Is it secure?
Server Action deletes any organization's project by id alone
- In testing
- Every test passes: the UI only ever lists the caller's own projects.
- In production
- Any signed-in user can resend the request with another company's project id, and that project is deleted.
async function deleteProject(id) { const user = await requireUser(); await db.project.delete({ where: { id } }); const res = await db.project.deleteMany({ where: { id, orgId: user.orgId }, }); if (res.count === 0) notFound();}| Finding | Location | Task |
|---|---|---|
| P0, Critical | app/actions/projects.ts:17 | Scope the project delete to user.orgId; 404 when nothing matches. |
| P0, Critical | lib/db.ts:3 | Public key in the browser, row-level security on, leaked key rotated. |
| P0, Critical | app/api/stripe/route.ts:26 | Verify Stripe's signature on the raw body before trusting the event. |
| P1, High | app/actions/domain.ts:13 | Check the plan inside setDomain, not only in the interface. |
| P2, Medium | components/SettingsForm.tsx:13 | Await the save and only say “Saved” when it worked. |
Fix prompt for CN-01, for Claude Code, Cursor or Copilot
In app/actions/projects.ts (lines 14-19), deleteProject checks requireUser() but deletes by id alone.
1. Scope the delete: where: { id, orgId: user.orgId }.
2. Use deleteMany and return 404 when result.count is 0.
3. Add a test: a user in org A cannot delete a project in org B.Reviewed by Muhammad Saeed. Every finding is checked by hand before it reaches your report.
Three engagements, in order
Start with the Review. Everything after it is quoted from what it finds.
Codeneath Review
A tour of your code and six answers at file:line, with fix prompts and a hand-off sheet.
From $499
About 5 working days for a small app
Fixed written scopeFix with your own team or AI
Paste the scoped fix prompts into Claude Code or Cursor, or hand the prioritized sheet straight to your engineer.
Hardening
Quoted · from the reviewWe fix what the review found, most serious first, priced by milestone.
Re-review
Quoted · with the reviewConfirm the fixes held, or check a new release against the report.
From call to close
Fit call
Free, 30 minutes
Scope
Written scope, permission and NDA
Access
Read-only Git or a .zip
Review
About 5 working days for a small app
Walkthrough
The report, explained on a call
Close
Your code deleted
What does your app use?
Pick the parts your app has to see what a Review checks in each.
Tap the parts your app has
Your Review plan
- AI and API keysQ2 · SecureServer keys never reach the browser bundle or the logs.
- Sign-in and teamsQ2 · SecureEvery read and write is scoped to the signed-in user's organization.
- Payments and webhooksQ5 · FailureWebhook signatures verified; each event applied once, even on retries.
3 areas, checked first, then the rest of the six questions.
Add them to your first email →Clear terms, in writing
In every contract
- Written scope and permission first
- NDA; your code deleted at close
- No guarantee; liability capped at the fee
- Live testing only on staging, in writing
Not offered
- Penetration tests of live systems
- Compliance audits (SOC 2, ISO 27001, PCI DSS)
- Certificates or guarantees of security
- Incident response
Questions founders ask
Anything else goes straight to the engineer: contact@codeneath.dev
- Replies within 2 working days
- No sales sequence or account hand-off
- Written NDA before any code is shared
Do you need access to my live app?
No. We read the code through read-only Git access or a .zip. Live testing happens only on a staging copy, with your written permission.
Do you use AI on my code?
Yes. Claude speeds up the mapping, under settings that don't use your code to train public models. Muhammad Saeed checks every finding by hand before it reaches your report.
What happens to my code afterwards?
An NDA covers it from the start, and it's deleted when the engagement closes. A case study happens only with your written permission.
Can you fix what you find?
Yes. Hardening is quoted from the review's findings and priced by milestone, most serious first. Or paste the fix prompts into your own AI tool.
Is this a penetration test or a compliance audit?
No. We don't test live systems, run compliance audits (SOC 2, ISO 27001, PCI DSS), certify security or handle incident response.
Is my stack a fit?
Ask on the free fit call. If a Review isn't the right fit for your app, we'll say so before any work starts.
Start with a free fit call
30 minutes to see whether a Review fits your app.