Fresh-clone build & test
We clone from nothing, build it, and run your tests, then report honestly whether it works and how many tests actually pass.
Forgehaven Labs · Overnight Audit
Your repo, audited overnight. A real fix plan by morning.
A fixed-price code audit that an agent fleet runs and a human engineer verifies. You get findings with evidence, a severity call by impact, and a 30-day plan you can actually book time against. Not a scanner dump. 24-hour turnaround.
Fixed price · 24 hours · every finding verified by a human before it ships
What you get
A report written for your next 30 days
Every audit runs the same passes on a fresh clone of your code. Then a director-level engineer reads the whole thing, reproduces the findings, and cuts the noise before you ever see it.
Dependency & supply-chain scan
Known CVEs, unmaintained packages, and license conflicts, with the exact advisory IDs and the one-line fix for each.
Secrets & config sweep
Committed credentials, weak fallback secrets, and unignored env files. We report type and location only, never the value.
Security review of the hot paths
Injection, authorization, and input-validation review on the code that actually handles auth, money, and user data.
Severity by impact, not by cleverness
P0 to P3, ranked by what it costs you if ignored. False positives are killed in a human review gate, so the list is real.
A sequenced 30-day fix plan
Grouped by work session with time estimates, plus quick wins under 30 minutes each, and an honest list of what we did not check.
The 24-hour promise
Ordered today, delivered inside 24 hours.
The pipeline is roughly 85% automated, so the clock is never at the mercy of a busy week. An agent fleet handles the clone, the build, the scans, and the first draft; a human spends about twenty minutes verifying the top findings and hits send. If a repo turns out to be out of scope, we tell you within the first hour and refund. If we find nothing wrong, we tell you that too, with the receipts.
Pricing
Two fixed prices. No hourly, no surprises.
Repo Audit
$149
A full code audit of one repository, delivered in 24 hours.
- Fresh-clone build and test run
- Dependency and supply-chain scan with advisory IDs
- Secrets and config sweep
- Security review of the hot paths
- Severity-ranked findings with file-and-line evidence
- 30-day fix plan, quick wins, and honest limits
- One round of follow-up questions included
App Store Rescue
$249
Rejected by App Review? We decode the real reason and hand you a resubmission plan.
- Everything in the Repo Audit
- Decode of the cited guideline vs the real trigger
- Metadata, entitlements, IAP, and privacy-label review
- Exact binary and App Store Connect changes to make
- The Review Notes text to paste, ready to go
- The other rejection magnets we spot before Apple does
- An honest read on whether the resubmission passes
Secure checkout via Stripe. You will receive an intake form right after payment; the 24-hour clock starts when we have repo access.
See it first
Two full sample reports on public code
We ran the exact process against two popular open-source repos and published the reports unedited. Read them before you spend anything.
http-server (Node)
A boolean-vs-string bug that silently keeps directory listing on in the library API, dotfiles served by path, and four production CVEs. Grade: B.
Read the report →microblog (Flask)
A weak fallback secret that makes password-reset tokens forgeable, an unignored .env, and 17 of 54 pinned dependencies with published CVEs. Grade: C+.
Read the report →Start an audit
Tell us about your repo
Already paid, or want to ask before you buy? Send the details below and we will confirm scope and timing. Everything on this page is run by Steven Green, Forgehaven Labs LLC.
Email us the following and we will reply within one business day:
- Repo URL, and how you will grant read-only access if it is private
- Branch or commit to audit
- Tier: Repo Audit ($149) or App Store Rescue ($249)
- Your stack, and the one thing you are most worried about
- App Store Rescue only: paste your rejection message
Prefer to just start? Pick a tier and the intake form follows checkout.
Honest answers
FAQ
Is this just a scanner running on a timer?
No. The fleet does the mechanical passes, but a human engineer reproduces and prunes every finding before delivery. The value is what gets cut, not what gets flagged. The microblog sample even has a section listing things that are not problems.
What if you find nothing?
That is a finding. You get the green scorecard plus a clear account of what we checked and why the repo is solid. A clean bill from a real audit has value.
Do you keep my code?
No. Your code is cloned into a throwaway working directory and deleted at close-out. Any read-only access key you issue should be revoked afterward; we remind you to. Secrets are reported by type and location only, never by value.
Can you guarantee my app gets approved?
No one honestly can. What we give you is the real reason behind the rejection, the exact changes to make, and an honest read on the odds. We are engineers, not lawyers.
What languages and stacks do you cover?
Node, Python, Swift/iOS, Go, and most mainstream web stacks. If your repo is out of scope, we say so within the first hour and refund, no charge.