Application, Automation & Repository Security Audit
A read-only security audit of custom apps and code repositories, automations built in Make, n8n or Apps Script, the webhooks that trigger them, and the credentials they use — every finding verified against evidence and ranked by severity, with fixes as a separate, approved next step.
STYD audits custom apps, code repositories and automations built with Make, n8n, Google Apps Script and webhooks for authentication, authorization, exposed credentials including Git history, public write paths, data exposure and deployment controls. The audit is read-only with no exploit attempts, and every finding is reported with severity, evidence status and remaining uncertainty; fixes are a separate, approved step.
The problem
Business operations often run on code nobody fully owns any more: an internal dashboard built by a freelancer, an app built quickly with AI coding tools, Apps Script copied between people, n8n or Make flows triggered by webhooks. Typical gaps are ordinary but serious — webhooks that accept any caller, credentials left in code or Git history, logins that trust the browser, production deploys from any push, and old copies that still hold access to live data.
Who it's for
Businesses whose operations depend on custom apps, scripts and automations built by several people over time — including apps built fast with AI coding tools — and teams that inherited code or want a clear security baseline before rebuilding.
The outcome
A verified, prioritized picture of the security risks in your code and automations — what is confirmed, what is still uncertain, and what to fix first — so decisions rest on evidence, with a clear path to fixing what matters.
What STYD delivers
STYD first inventories the repositories and automation projects in scope and classifies copies and retired ones, so the detailed review stays on what still holds access. The review covers authentication and authorization, credentials in current code and Git history (recorded by location, never by value), public write paths, sensitive-data exposure, deployment triggers, and automation-specific risks such as webhook verification, execute-as identity and OAuth scopes. Each concern is confirmed against evidence — in current source, Git history or the live deployment — or clearly marked as inferred, and severity is kept separate from certainty, so a possible issue is never presented as a confirmed incident. The report ranks findings Critical to Low with evidence, remaining uncertainty and remediation priorities. Fixing confirmed findings is a separate, approved hardening step, quoted from the results.
Common questions this service helps with
- Google Apps Script security audit
- webhook security review
- find secrets in Git history
- n8n automation security audit
- security review of app built with AI coding tools
- code security review for small business
Pricing
Final pricing is confirmed after a short scoping conversation.
FAQ
No. The audit is read-only. Read access to the repositories and automation projects in scope is enough, plus read-only deployment settings where they change the severity of a finding.
No exploit is attempted and no attack traffic is sent. Findings are confirmed from source code, Git history and read-only deployment evidence.
Not necessarily. Anything committed to Git stays in its history, and copies may exist in clones and forks. The real fix is rotating the credential, which the report flags.
Not in itself, but fast builds often skip caller checks, put keys in code, and deploy straight to production. The audit looks for exactly those gaps.
From $850, scaled by the number of repositories and automations in scope. Fixing confirmed findings is quoted after the audit, once you have chosen what to fix.
Code changes, server and hosting review, and ongoing monitoring. A database or Supabase security review and a business-logic and reliability audit are available on custom quote. This is not a penetration test or a certified compliance audit.
Related STYD services
A system is being built for your business — or by your team. Before more is built on top of it, get an independent written assessment of whether what exists today is sound enough to continue.
Find out what is really exposed on your Linux server, then have the safe baseline fixes applied — only with your written approval and a before/after report.
Your server is running hot, showing processes nobody recognises, or your host sent an abuse warning. Evidence is captured, the infection is cleaned, and you get an honest view of whether the server can still be trusted.
Tell us about your setup and we'll confirm fit, scope, and pricing.