Adversarial App Audit by VANDAM: Verified security findings with code fixes

This page as Markdown llms.txt llms-full.txt services.json sitemap.xml
# Adversarial App Audit by VANDAM: Verified security findings with code fixes

> A focused security review of your application. For each verified finding, you receive steps to reproduce the issue, the affected code and a proposed fix, together with the checks behind the report.

URL: https://vandam.ai/adversarial-app-audit  
Contact: hendrik@vibelab.be

# Verified security findings. Code fixes included.

A focused security review of your application. For each verified finding, you receive steps to reproduce the issue, the affected code and a proposed fix, together with the checks behind the report.

[Discuss the project](mailto:hendrik@vibelab.be?subject=VANDAM%20/%20Adversarial%20App%20Audit)

**$4,800** one week

## One missing check is the most common flaw on the web.

- **#1**
  Broken access control tops the [OWASP Top 10](https://top10.owasp.org/2025/A01_2025-Broken_Access_Control), the security industry’s standard list of web app risks, 2025.
- **#1**
  Reading another customer’s record by changing an ID tops the [OWASP API Security Top 10](https://api-security.owasp.org/editions/2023/en/0xa1-broken-object-level-authorization), rated easy to exploit and widespread.
- **$10.22M**
  average cost of a data breach in the US, a record. [IBM](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls), Cost of a Data Breach, 2025.

> Our research shows models are getting better at coding accurately but are not improving at security.
>
> Jens Wessling, CTO, Veracode, July 2025, [Source](https://www.veracode.com/press-release/ai-generated-code-poses-major-security-risks-in-nearly-half-of-all-development-tasks-veracode-research-reveals/)

So no, code that passes its tests can still show one customer another’s data.

## Give engineering something it can act on.

A security report that says access control is weak leaves engineering with the real work still to do: find where it fails and decide what to change. A useful finding names the request that breaks it, the code responsible and the fix.

We test sign-in, data access, storage and payments within an agreed scope, the places where one missing check exposes another customer’s records. Every issue is reproduced, then rechecked before it reaches the report. Your engineers get the reproduction, the affected files, a proposed code change and a test that shows the hole is closed.

## From a suspected issue to a reviewed fix.

1. Agree and map the scope: We identify the application boundaries to review, including who can sign in, which records they can access and how storage and payments are handled. Testing stays within the agreed environment and scope. Scope - Sign-in · email + Googlein scope
- Customer recordsin scope
- File storagein scope
- Payments · Striperead only
2. Reproduce the finding: We test realistic misuse cases and recheck any suspected issue. A finding includes the request or action that demonstrates it and the relevant files, so another engineer can follow the evidence. Finding 03 · reproduced - GET /api/invoices/8812
- signed in as: customer A
- 200 OK · returns customer B’s invoice
- file: api/invoices/[id].ts, line 14
3. Deliver the code change: We prepare replacement code with the location and reason for the change. The review record keeps the original reproduction, supporting evidence and checks together so your team can assess the fix. Fix · api/invoices/[id].ts - const invoice = await db.invoice.find(id)
- const invoice = await db.invoice.find({ id,
- ownerId: session.user.id })
- if (!invoice) return notFound()

## Tested this week. Retested after each release.

The report describes your application as it was during the audit week. Every release can add a route or remove a check, so after delivery we can rerun the reproductions and test what changed.

- Fix verification: We rerun the original reproduction against each fix your team ships, and record the result in the finding.
- Release retests: Before or after a release, we retest the findings and routes it touches.
- New scope: New roles, routes, storage or payment flows reviewed with the same method as the first audit.
- Check-ins: A short session with engineering on open findings, accepted risks and what the next release changes.

[Ask about retesting](mailto:hendrik@vibelab.be?subject=VANDAM%20/%20Adversarial%20App%20Audit%20care)

## What you receive.

- Verified findings: Reproduced issues linked to the relevant files and lines.
- Code fixes: Replacement code for the findings we verify.
- Review record: The scope, evidence and checks behind the report.

$4,800

one week

An indication from past projects. The final price can move a little with the size and complexity of your company, and we agree it in writing before we start.

For founders and engineering teams with a live application. Useful before enterprise review or after a security concern.

[hendrik@vibelab.be](mailto:hendrik@vibelab.be?subject=VANDAM%20/%20Adversarial%20App%20Audit)

## Where the audit leads. Each next step has its own service.

### Agent Attack Audit

When the app has agents or AI features: the same adversarial testing, aimed at them.

**$6,400**

### Agent Ops

Keeps watch after the fixes, so the same findings do not come back.

**$3,200/mo**

### MCP Retrofit

Once the app holds up: an interface assistants and agents can use safely.

**$12,800**

Developers with an AI assistant wrote significantly less secure code, and were more likely to believe it was secure. ([Stanford](https://arxiv.org/abs/2211.03622) study by Perry, Srivastava, Kumar and Boneh, 2023)

## Before you ask.

### Do you test on our production system?

We agree the environment and the test accounts before we start, and testing stays inside them. Anything outside the agreed scope is left alone.

### What if you find nothing serious?

The report says so. The review record shows what we tested and how, so the result can be checked.

### Do our engineers apply the fixes?

Yes. We deliver replacement code with the location and reason for each change, and your team reviews and merges it.

### Can we share the report in a customer’s security review?

The report is yours to share. It covers the scope we agreed and says so, which matters if the customer asks about other parts of your system.