Enterprise procurement asks for a pentest summary and we don't have one to give yet. This page is the honest state: what's coming, when, and what we've done in the meantime to make sure the eventual findings are small.
Current status
Why we don't have one yet
Third-party pentests are useful once a product has enough surface area to be worth testing and enough revenue to fund a real firm's engagement (typical range $25-50K). We hit the second threshold in mid-2026; the engagement is now in procurement. Doing it sooner would have produced a report with limited value ('the code has since been rewritten') and used runway that was better spent on features + hiring an in-house security review.
Compensating controls until the test lands
- Static analysis on every PR (Semgrep + type-safe TypeScript strict mode).
- Dependency vulnerability scanning weekly (Dependabot + npm audit); high-severity CVEs patched within 48 hours.
- Multi-tenant isolation at the database layer verified via row-level security policies + property-based tests.
- Standing production access limited to one named person; MFA required; audit logs retained. See /security/access-controls.
- Coordinated-disclosure program (see /security/vulnerability-disclosure) accepting external researcher reports.
- Anthropic (our LLM provider) is SOC 2 Type II certified; our reliance on their infrastructure inherits some of their controls at the inference layer.
What the summary will look like when it publishes
A table of findings by severity (critical / high / medium / low / informational), remediation status per finding, and the remediation date. The full report will not be public — that's standard for pentest reports to avoid publishing exploit paths — but it's available under NDA to enterprise customers who ask.
SUBSCRIBE TO /NEWSLETTER FOR THE SHIP ANNOUNCEMENT · MONTHLY EMAIL
Related
/security · Incident history · /business/procurement (SOC 2 status + compensating controls in detail).