Continuous Correctness Audit · for agencies and delivery firms
Every finding we hand you is a test that failed on your client's main.
We write down what your client's software promises. Then we show you where it breaks one. The remediation is yours.
Production depth: Go, Rust, JavaScript, TypeScript, Solidity. Newer: Python, Zig, Java, C#. Mostly Java or .NET? Say so early. · Who you would deal with
Capacity is getting harder to sell than results.
A client who bought eight engineers asks what the number is now that a model writes the first draft. Procurement compares your rate card against three firms with the same capability deck. Growth inside your own accounts needs a better reason than “we have people available”.
The real work stays invisible. Your team feels it in the estimates they pad. You cannot put it in a proposal, because “this needs work” is an opinion, and your client has one already.
A finding is a work order.
We index the client's code first. Their history and support queue supply the why. Out of that comes a written record of the promises the software makes, approved by the engineers who own it. Then a register of the places where the code breaks one. A finding looks like this:
jsonparser/proof/known-issues/KI-3.yaml ← real, public, on master id: KI-3 title: Set with array-index path component under an object parent produces malformed JSON output affected_requirements: - SYS-REQ-009 - SYS-REQ-110 - SYS-REQ-112 severity: high severity_basis: reproducer reproducer_command: go test -v -run TestSetArrayIndexUnderObjectMalformedJSON_KI3 ./... status: fixed
Read it as a scope document. The requirement says what the software owes. The reproducer is the acceptance test. It is agreed before anyone writes a line of the fix. When it goes green, the gate re-checks the requirement, the traceability and the coverage.
The gate then stays in the client's CI and runs on every release without us. New findings are what the retainer buys, because a person has to read what changed. Read the whole record · what month twelve looks like
Why this one says fixed, and how we score severity
KI-3 is closed and the fix is upstream. That is why we can show you all 28 fields of a real record. Read it for shape, not as a demonstration of the headline. This particular test asserted the defect while it was live, then we inverted it to assert the fix. A delivered finding runs the other way: red on your client's main until the fix passes.
Severity is our assessment, weighted by reachability and impact; a starting point for your triage, not a CVSS determination.
The claim is bounded on purpose: within a declared scope, for declared behaviors, with evidence commensurate with the consequence of failure.
Your client's rules reach your code.
Three EU laws make your client prove their software works. Which ones apply depends on what they do. More than one can apply at once.
| If your client | The rule | They must be able to show |
|---|---|---|
| runs a cloud service, data center, CDN, managed service or marketplace, above small-enterprise size | NIS2 | A right to audit their suppliers, where appropriate. Documented results that what was delivered meets its security requirements. Outsourced development falls under the same rules. |
| sells a software product into the EU | Cyber Resilience Act | Regular security tests. A machine-readable bill of materials. Reporting from 11 September 2026, for products already on the market. |
| is a bank or an insurer | DORA, live since January 2025 | Unrestricted rights to inspect and audit any supplier of a critical function. The supplier joins their penetration tests. |
In each case the duty is your client's. They discharge it with evidence about the software. Somebody has to produce that evidence, keep producing it, and fix what it finds.
The citations, and what these laws do not say
NIS2 reaches those categories only at medium size or above, under its article 2(1). The size cap lifts only for electronic communications, trust services, DNS and TLD registries. In Implementing Regulation (EU) 2024/2690, the contract term is annex point 5.1.4(e), and it applies “where appropriate”. An entity that judges it inappropriate must write down why, under article 2(2). Point 6.1.2(f) is different: it governs the entity's own buying process, not the contract. Points 6.2.1 and 6.2.3 cover outsourced development, and they bind the regulated entity, not its supplier.
The Cyber Resilience Act binds whoever puts a product on the EU market under their own name, wherever the team sits. Reporting runs on a 24-hour early warning and a 72-hour notification. The final report is due at 14 days for an exploited vulnerability, or one month for a severe incident. Support runs at least five years, or the expected use time if that is shorter. Rules for notifying assessment bodies started on 11 June 2026. Conformity assessment itself, and most of the rest, starts on 11 December 2027.
DORA covers insurance and reinsurance undertakings. The contract terms are article 30, and 30(3) for critical functions. They apply where you supply ICT services on an ongoing basis, not where you wrote code once. Not every financial entity is picked for penetration testing.
None of these laws names a correctness audit, and we will not pretend otherwise. A certified penetration test is an accredited firm's report, and it stays theirs. We produce the engineering evidence underneath one. This is a summary of the law in August 2026. It is not legal advice. Your client's counsel owns that call.
Four things you can sell.
01
A reason to be in the room
You arrive at a review with specific, evidenced defects in the client's own code. That is not the meeting where you ask whether budget opened up.
02
Acceptance stops being an argument
A machine decides when a finding is closed, and both sides can run it. It does not size the effort: a red test can mean an afternoon or a month, and that risk stays yours to price.
03
Staff changes cost you less
A new engineer's first pull request is graded against approved promises, not against whoever still remembers. When something breaks, the record carries the origin we could establish.
04
Something to say in an RFP
Every firm on the shortlist claims senior people. You commit to an independent correctness audit, and the reader can check it: the bar is published, and so is a defect we missed.
There are three ways in.
you introduce us
Into an account you hold
You introduce us and sit in the scoping call. We quote the client a fixed fee. Four weeks after they approve the requirements, the register and the gate are in their repository. In your accounts we do not quote fix work.
we introduce you
Into an account with no capacity
A register often lands where nobody is free to work it. We introduce a partner, and the register is already written. This route only works once we have engagements to introduce you into.
on your own work
As a gate on what your team ships
Run it on a component your engineers maintain. From that day a regression points at the change that broke a named requirement.
Start with a secure account, not your largest. Three things hold on every route.
It keeps running
The record and the gate stay in the client's repository and work without us.
Evidence or nothing
A finding ships with a reproducer, or it does not ship.
Written first
The terms are agreed before any introduction.
What we agree with you.
| Question | Answer |
|---|---|
| Who bills the remediation? | You do, in full, at your own rates. We take nothing from fix work in your accounts. |
| Who pays for the audit? | The client. A fixed fee, quoted after scoping. Ask on the first call and you get the order of magnitude, before you spend credit with the client. |
| What does an introduction earn? | An introduction fee, or a partner rate on the audit. We agree which, in writing, first. Your client is told the amount before we quote them. |
| Can you resell it as your own? | No. The findings work because we are not paid to fix them. Co-present, name us in the proposal, but do not white-label us. |
| Is it exclusive? | We have no standing policy. Exclusivity is one of the things the written term settles, by account or by market. |
| What happens after week four? | The audit continues at a flat monthly fee, if the client wants it. That is our repeat revenue, and you should know it exists. It buys audit work only. |
Access to the client's code, and what we do not hold
Two models. A public repository, or private code under an NDA we countersign before we read a line. Access is read-only, and scoped to the component.
Engagement code reaches three AI subprocessors, Anthropic, OpenAI and xAI, only through their commercial APIs, under terms that exclude training on customer data. If your client's policy excludes a provider, the engagement runs on the ones they allow.
Two answers their reviewers will want first: we hold no SOC 2 report, and we delete what we hold within 30 days of exit. The rest is on Trust. Where your client's own NDA governs, we read it and work inside it. We do not promise to comply with a document we have not seen.
None of the above is an offer you can accept. A signed agreement binds us; this page does not. And this is new: no outside team has yet run a remediation program off one of these registers. Our one public audit ran on a Go library of ours and found seven real defects. What that means for a component your size is what a first engagement would tell us both.
Ask these first.
“It will find things my team shipped.”
It will find things everyone shipped, including whoever came before you. A finding records the change that introduced the defect, because “when did this start” is useful. Records name the engineer who owns a fix and whoever reviewed it. That is accountability for the fix, not blame for the bug.
You are also the firm that brought the standard in. From the day the gate lands, you hold a record of what was true before your team touched the code.
“What if it finds more than my client will pay to fix?”
Then they have a plan. Findings carry severity, so the queue is orderable and nothing has to be fixed at once. A client who defers a low-severity finding has made a decision on the record. Without the register those defects are still there, and nobody's name is on the decision to keep them.
“Will you compete with us on the fixing?”
We sell fix sprints for clients who have nobody. We would rather have somebody, which is why this page exists. In your accounts we do not quote them.
More usefully, we do not sell staff. No engineers in your client's teams, no seats, no dev hours. The only fee we charge again is for the audit.
Fix work is priced separately, so the party grading a fix has no stake in having written it. DO-178C uses the same rule for airborne software: at higher criticality levels, the check is done by someone other than the author. That rule protects the gate, not your revenue. The written term protects your revenue.
One more, since we raised it. An introduction fee gives us a commercial tie to the firm writing the fixes we grade. Two things bound it: the fee attaches to the introduction, never to how much we find, and your client sees it in writing. If that is still too close, we will take the engagement without a fee.
“Is this a pile of machine-generated bug reports?”
The checks are deterministic instruments: solvers, coverage measurement, link resolution. They run at a volume no person could reach. Most of what runs reports nothing. What surfaces is a much smaller set, and a person clears it one at a time.
A finding ships with a reproducer that fails on the client's main, or it does not ship. That is a commitment in the contract, not something the gate can prove to you. You can check our published miss instead. A defect escaped one of our own audits under full coverage. The postmortem names the gap.
“Our client contract will not let us add a subprocessor.”
The audit contract is between us and your client. You introduce us, they engage us, they countersign the NDA. In most arrangements that puts us outside your master agreement. That depends on your paper and on whose data is in scope. Treat it as a question for your counsel, not an answer from us.
“What does this cost us and our client in time?”
From your client: about two hours of the owners' time in week one, to approve the requirements. Then a named contact for escalations, and a walkthrough in week four.
From you: an introduction, an owner for the relationship, and a seat in the room. After that, the work you take on is the work you already sell, and it arrives pre-specified.
We read code. We do not write it. The record and the gate arrive as a pull request their engineers merge.
A fit, or not.
A fit if
- You deliver software for clients, as an agency, an outsourcing partner, or engineers inside their teams.
- You hold an account where you could raise this with a VP of Engineering.
- Your engineers could take a queue of reproducers and burn it down.
- You would rather compete on what you can prove than on your rate.
Not this page if
- You want published margins and a partner portal. We have neither.
- You need a certified penetration test. Engage an accredited security firm.
- You want the audit branded as your own work.
- Your own team would be the one told about the findings. Read the engagement instead.
Start with an email.
Your email is enough. We reply personally, with a call or an honest no. Nothing is agreed until it is in writing.
The engagement · Methodology · Findings · AI-native systems · Trust · About