secrets01
Exposed secrets
API keys and service tokens in the front end, in the repository or in logs. Opening DevTools is enough.
Application Security · DevSecOps · DevOps
Your code was written fast.
Now it needs to be secure.
Security audits, penetration testing and DevSecOps for companies that build software with AI, and for those that don't yet. I find the flaws before an attacker does, deliver the fix and set up your pipeline so they don't come back.
- NDA before any access
- Executive and technical report
- Retest included
Methodology aligned with
- OWASP Top 10
- OWASP ASVS
- OWASP API Security
- OWASP Top 10 for LLM
- CVSS
- CWE
- CIS Benchmarks
- LGPD
The problem
AI speeds up delivery. Vulnerabilities keep pace.
Cursor, Copilot, Lovable and Bolt produce code that works in the demo. Working, however, is not the same as secure, and the same failure patterns repeat from project to project.
authz02
Broken access control
RLS disabled, routes that trust the ID sent by the client and permissions checked only in the UI.
supply-chain03
Insecure dependencies
Suggested packages that don't exist and can be registered by attackers, versions with known CVEs, lockfiles ignored.
llm04
LLM-powered applications
Prompt injection, data leakage through context and agents with more permissions than they need.
misconfig05
Default settings in production
Debug mode on, open CORS, public buckets and missing security headers.
ops06
No operational visibility
Manual deploys, scattered logs, backups never tested and no alert when something goes wrong.
Services
From code review to production infrastructure
Security and operations handled together, with findings your team can actually fix, not a generic scanner report.
Core
AppSec · AI
Security audit for AI-built applications
Code review and testing of the running application, targeting the flaws AI tools tend to introduce. Recommended before launch, before fundraising or before opening the application to customers.
- Manual code review, with SAST, SCA and secret scanning
- Authentication, authorization, RLS and tenant isolation
- BaaS (Supabase, Firebase) and cloud configuration
- Findings with proof of concept and recommended fix
- Executive report for leadership and technical report for the team
- Retest after fixes
Pentest
Web application and API penetration testing
Manual penetration testing guided by the OWASP Top 10, API Security and ASVS, for applications built with or without AI. Black, grey or white box, depending on scope.
- Web applications, SPAs, REST and GraphQL APIs
- Business logic, IDOR, SSRF and injections
- CVSS severity and reproducible evidence
LLM
Security for LLM applications and agents
Assessment of chatbots, RAG pipelines and agents based on the OWASP Top 10 for LLM Applications: what the model can see, say and do.
- Direct and indirect prompt injection
- Data and system prompt leakage
- Tool permissions and agent actions
DevSecOps
CI/CD pipeline security
Automated controls so the next vulnerability is stopped at the pull request, not discovered in production.
- SAST, SCA, secret scanning and SBOM in the pipeline
- Branch protection and mandatory review
- Secrets management outside the repository
DevOps
Infrastructure, deployment and operations
Reproducible infrastructure, automated deployment and visibility into what happens in production.
- Containers, Docker Swarm and orchestration
- CI/CD and infrastructure as code
- Hardening, backups, monitoring and alerting
Who it's for
Companies that ship software to production
Startups and SaaS
An AI-built MVP heading to paying customers, due diligence or a funding round.
Software houses and agencies
Independent security validation before handing over to the end client.
Internal teams
Internal tools built with AI, often by people who aren't developers.
Regulated companies
Teams handling personal data under LGPD or GDPR that need to show technical due diligence.
Methodology
Defined scope, authorized testing, verified fixes
A predictable process, from first contact to retest.
- 01
Scope and authorization
Technical call, NDA and an authorization document with targets, testing windows and limits.
- 02
Assessment
Code review and testing of the application and infrastructure within the agreed scope.
- 03
Report
Risk-prioritized findings with evidence, impact and recommendations. Walkthrough with the team.
- 04
Fix and retest
Support with remediation, retesting of findings and CI controls to prevent regressions.
What you get
- Executive report with the risk level in business terms
- Technical report with evidence, impact and reproduction steps
- Remediation guidance for every finding
- Results walkthrough with the technical team
- Retest with the final status of every finding
- CI rules to prevent regressions, where applicable
Who leads the work
Direct access to the person doing the work
Leno Seibert
Founder · Application Security and DevOps
Over nine years in technology, working across infrastructure, automation, development and the security of production systems. At MKTSYS, every project is run end to end by the same person, from scoping to retest.
- years in technology
- 9+
- technical certifications
- 15+
- projects delivered
- 150+
Manually validated findings
No lists of false positives: every finding is confirmed and backed by evidence.
Remediation, not just diagnosis
Recommendations specific to your stack, with hands-on support when needed.
Security and operations together
The person testing also understands deployment, infrastructure and CI/CD, and fixes things at the source.
Confidentiality first
NDA, temporary access and disposal of project data at the end of the engagement.
Engagement
Three ways to work together
Scope and investment agreed before work starts. No surprises along the way.
Rapid assessment
An objective view of your risk before deciding the next step.
- Review focused on the most critical areas
- Automated scanning with manual analysis
- Short report with priorities
- Fixed price
Recommended
Full audit and pentest
Fixed scope, from testing to retest.
- Code review and application pentest
- Executive and technical report
- Findings walkthrough with the team
- Retest included
Ongoing security and DevOps
Monthly hours for teams shipping software every week.
- Security review of new features
- Pipeline and infrastructure maintenance
- Monitoring and alert response
- Monthly hour packages
Every engagement starts with a free technical call and is only carried out with formal written authorization.
FAQ
Before we start
Do you test without authorization?
No. Every test is performed only with formal authorization from the system owner, with targets, time windows and limits defined in writing.
Can testing affect production?
Whenever possible, testing happens in staging. In production, it takes place during agreed windows, without denial-of-service attacks and with a contact point for immediate interruption.
Are my code and data protected?
The NDA is signed before any access. Access is temporary, test data is preferred and project material is disposed of at the end, as agreed.
My application wasn't built with AI. Does this still apply?
Yes. The methodology applies to any application; the focus on AI-generated code only adds specific checks for the mistakes these tools repeat.
Do you fix issues or only report them?
Both. The report includes a recommended fix for every finding and, if it makes sense, implementing the fixes and the retest can be part of the scope.
How long does it take and how much does it cost?
It depends on the size and complexity of the application. A rapid assessment usually takes a few days; full audits and pentests are sized during scoping, with timeline and investment defined in the proposal.
Contact
Tell me what needs to be assessed
I'll get back to you with next steps and, if it makes sense, we'll schedule a free technical call.
Direct contact