SaaS review with fix pull requests - Proof that one customer can never see another.

A multi-tenant security review for Next.js, Supabase and Firebase apps. Every confirmed finding ships with a pull request your engineers review and merge.

From $6,500
$4,500 with an AI or voice test
4 to 6 tester days
Retest and attestation letter
Fixes as pull requests

Get a quote See a sample report

What we test

Tenant isolation in every data layer, including Supabase RLS
Roles and permissions inside a tenant
SSO, API keys and webhook verification
Storage rules and signed URLs
Admin and support impersonation paths
Secrets shipped to the browser

Scope and price - What one test covers

One web application with one tenant model, up to 40 API routes and one database.

What raises the price

More API routes or services
SSO, SCIM or delegated admin
File storage with shared links
Several databases or regions

Typical engagement

Starting price: From $6,500, or $4,500 with an AI or voice test
Testing time: 4 to 6 tester days
Start: Usually within two weeks of the signed scope
Report: Within three business days of the last testing day

A good fit

Next.js, Supabase or Firebase products with more than one business customer
Apps built quickly with AI coding tools that now hold real data
Teams who want fixes, not only findings

Not a fit

Single user consumer apps with no tenant boundary
Systems in PCI cardholder data scope where we would also write fixes
Native mobile binary analysis

Example finding - What a finding looks like

Based on a real cross-customer finding from our team's previous work, written in the format of our reports.

CRITICALWK-003OWASP API1 BOLA, SOC 2 CC6.1

Any signed-in user can read another customer's invoices by changing an ID

Reproduced: Every attempt
Root cause: The invoice route trusted the tenant ID sent by the browser.
Fix: Tenant taken from the session on the server and enforced by a row level security policy. Pull request with regression test.
Retest: Denied for every foreign ID. Closed.

Mapped to the standards your buyers check

Area	Standards
Tenant isolation	SOC 2 CC6.1, ISO 27001 A.8.3, OWASP API1
Roles inside a tenant	SOC 2 CC6.3, OWASP API5
SSO, keys and webhooks	ASVS V2, V3, OWASP API2
Storage and signed URLs	ISO 27001 A.8.12, SOC 2 C1.1
Impersonation paths	SOC 2 CC6.2, CC7.2
Secrets in the browser	ISO 27001 A.8.24, ASVS V14

Independence - We write the fix. You stay in control.

Fixes as pull requests are the fastest way to close a finding. These rules keep the evidence independent.

You merge. We open pull requests from a fork or a branch you protect. Your engineers review and merge every one. We never hold merge or deploy rights.
Different retester. The person who wrote a fix never retests it.
Disclosed in the letter. The attestation letter states which fixes we wrote.
Regression tests. Every pull request ships with a test that fails before the fix and passes after.
Your test tenants. We test only your project and our own test tenants, never other customers of your platform provider.
No PCI scope fixes. We do not write fixes for systems in PCI cardholder data scope that we also test.

What you get - Evidence, fixes and a letter you can send.

A report your auditor can sample. Scope, method, dates, every finding with severity, proof and the exact fix. Written so an auditor can trace a finding from discovery to closure.
Fix pull requests. Confirmed findings ship with a pull request and a regression test. We open them from a fork or a branch you protect, your engineers review and merge, and we never hold merge or deploy rights.
Free retest within 90 days. A tester who did not write the fix confirms it holds, and the report is updated with before and after evidence.
Signed attestation letter. A one page letter for your customers and investors, signed by the lead tester, with an ID your customer can check with us.
Questionnaire answers. We answer the pentest and AI lines of the questionnaire your customer sent, each one pointing to the part of the report that proves it.

Related evidence

Our team's previous work. Client names stay private, the numbers come from the engagement record.

A full audit of a multi-tenant voice and chat AI platform

Security and compliance audit

A production platform where businesses run AI phone and chat agents for their own customers, with telephony, payments and thirteen CRM integrations.

Two critical cross-customer bugs in a B2B SaaS

Grey-box penetration test

A B2B platform used by 340 business customers, tested with partial access (grey box).

61,000 customer records found on a forgotten staging store

External attack surface review

We mapped 187 DNS records and 63 live hosts across three brands.

Combine - Often bought together

From $6,500AI agent security testHands-on testing of LLM features, RAG, agents and MCP tools. We follow injected instructions all the way to a tool call and check what leaks between your customers.

From $8,500Voice agent security testWe phone your AI agent, try to break it, and check the parts a simulated caller cannot see: recordings, tool authorization, telephony and consent.

From $4,000SOC 2 readinessA gap assessment from $4,000, or full readiness from $12,000: policies written around how your team works, technical fixes and evidence in Vanta or Drata, through to the auditor's fieldwork.

From $2,500 a monthFractional security leadA named security lead for questionnaires, audits, vendor reviews and a quarterly test plan, until you hire your own.

FAQ - Questions buyers ask

Do the pull requests follow our code style?

Yes. We follow your linting, tests and conventions, and keep each pull request small enough to review in one sitting.

Will my SOC 2 auditor accept your report?

Auditors look for scope tied to your systems, a named method, dated testing, findings with severity and evidence that fixes were retested. Our reports are written to that list.

Who writes the fixes, and how do you stay independent?

We open pull requests from a fork or a protected branch, your engineers review and merge them, and a tester who did not write the fix retests. The attestation letter says who wrote each fix.

Do you test production?

We start with staging or dedicated test tenants. Production is tested only with your written risk acceptance.

Where are you based?

Wardkey is a brand of Meridal Group LLC, a United States company. Testing is performed from the EU. We do not take work that requires US-person testers, such as FedRAMP, CJIS or ITAR scope.

How long does it take?

Most tests start within two weeks of the signed scope and take four to eight tester days. The report follows within three business days.

What if you find nothing?

Then the report says exactly what was tested and how, which is what your customer's reviewer needs to see.

Send us the questionnaire your customer sent.

We will tell you which lines a test answers, in writing, within one business day.

Get a quote

Who we are

CompanyMeridal Group LLCWyoming, United States
TestingPerformed from the EUFor clients in the US and Europe