Services
The Bug Clinic
Priced per engagement, by scope
Bring us code you own, or are authorized to submit, and we review it for logical bugs, hidden or undocumented behavior, and the kind of mistakes that pass code review but not production — unsafe patterns, hardcoded secrets, broken checks, and off-by-the-wrong-assumption logic.
- Intake. Tell us what you want reviewed and which methods you're comfortable with (static analysis, secret scanning, dependency checks, or manual review).
- Agreement. We send back a plain-text engagement naming the exact scope and methods. You confirm you own, or are authorized to submit, the material, and sign.
- Submission. You send the code as a zip archive. It's stored in an isolated workspace for this engagement only, and expires automatically after the review window.
- Review. We run only the methods your agreement lists. This is source-level analysis — we never execute your code or touch a running system.
- Report. Every finding is reviewed by a person before release. Secret values are redacted; you get the location, the risk, and a fix.
- Delivery. You receive the report. Either side can withdraw the engagement at any point, which deletes the submitted material immediately.
Small software engagements
Fixed-price, scoped up front
Bug fixes, scripts, small integrations, test suites, and documentation — scoped and quoted before work starts, delivered for your review.