Application and build review
A read-only security audit of custom apps and code repositories, automations built in Make, n8n or Apps Script, the webhooks that trigger them and the credentials they use, every finding verified against evidence and ranked by severity. And, for a system under construction, an independent written assessment ending in a clear position: Proceed, Proceed with conditions, or Rework before continuing.
STYD audits custom apps, code repositories and automations built with Make, n8n, Google Apps Script and webhooks (authentication, credentials in Git history, public write paths, deployment triggers, OAuth scopes) and delivers independent build verifications of systems under construction, ending in Proceed, Proceed with conditions, or Rework before continuing.
The problem
Business operations often run on code nobody fully owns any more: an internal dashboard built by a freelancer, an app built quickly with AI coding tools, Apps Script copied between people, n8n or Make flows triggered by webhooks. Typical gaps are ordinary but serious: webhooks that accept any caller, credentials left in code or Git history, logins that trust the browser, production deploys from any push. And when a system is still being built, the business cannot judge the work until something breaks: demos look fine, while the structural problems sit underneath.
Who it's for
Businesses whose operations depend on custom apps, scripts and automations built by several people over time, including apps built fast with AI coding tools; business owners paying for a custom build who cannot assess its technical quality themselves; and agencies or builders who want an independent check before a milestone, a handover or go-live.
The outcome
A verified, prioritised picture of the security risks in your code and automations: what is confirmed, what is still uncertain, and what to fix first. For a build in progress, a clear independent answer to whether what exists today is sound enough to keep building on, with the evidence behind it, so the next milestone, payment or go-live decision rests on facts rather than on a progress report.
What STYD delivers
STYD first inventories the repositories and automation projects in scope and classifies copies and retired ones, so the detailed review stays on what still holds access. The review covers authentication and authorisation, credentials in current code and Git history (recorded by location, never by value), public write paths, sensitive-data exposure, deployment triggers, and automation-specific risks such as webhook verification, execute-as identity and OAuth scopes. For a build verification, STYD also reviews the architecture, the data model, migrations, tests and any implementation evidence supplied, across security, identity and data integrity, synchronisation and migration risk, with non-destructive validation runs where access allows. Each concern is confirmed against evidence or clearly marked as inferred, and severity is kept separate from certainty, so a possible issue is never presented as a confirmed one.
Common questions this service helps with
- Google Apps Script security audit
- webhook security review
- find secrets in Git history
- n8n automation security audit
- security review of app built with AI coding tools
- independent code review for software project
- second opinion on developer's work
- third-party review of custom software build
Pricing
Final pricing is confirmed after a short scoping conversation.
FAQ
No. The review is read-only. Read access to the repositories and automation projects in scope is enough, plus read-only deployment settings where they change the severity of a finding.
Not necessarily. Anything committed to Git stays in its history, and copies may exist in clones and forks. The real fix is rotating the credential, which the report flags.
Not in itself, but fast builds often skip caller checks, put keys in code and deploy straight to production. The review looks for exactly those gaps, and a build verification checks whether the data model and the structure can carry the real business rules.
It is broader. A code review looks at code quality; a build verification looks at whether the system as a whole, its architecture, data model, migrations, controls and data integrity, is sound enough to continue, and ends in a position you can act on.
No. The review is independent precisely because the reviewer is not building or fixing the system. The report gives corrective direction and ranked findings; the builder, or anyone you choose, implements them, and fixes can be quoted separately once you have chosen what to fix.
The security audit from $850, scaled by the number of repositories and automations in scope. A build verification from $1,900 per review, scaled by the size of the system; one review covers the state examined, and a check after later changes is a separate review.
Code changes, server and hosting review, ongoing monitoring, training and live development direction. A database or Supabase security review and a business-logic and reliability audit are available on custom quote. This is not a penetration test or a certified compliance audit.
Related STYD services
Find out what is really exposed on your Linux server, have the baseline fixes applied with your written approval, and if the server is already infected, get it cleaned with the evidence kept.
A practical review of how your company runs on its tools: workflows, reports, automations, integrations, hosting. It ends in a prioritised list of what to fix first.
Ongoing senior technical help across AI, automation, integrations, data, Odoo and internal tools, a few days a month, without hiring a full-time engineer.
Tell us about your setup and we'll confirm fit, scope, and pricing.