How We Audit
Same methodology as enterprise security teams. AI-powered delivery. No code access required.
The Framework
OWASP Top 10
The Open Web Application Security Project Top 10 is the global standard for web application security, maintained since 2003 and adopted by Google, Amazon, Microsoft, and government agencies worldwide. It covers the most critical security risks to web applications — from injection flaws and broken authentication to insecure design and server-side request forgery. Every LRC audit checks all ten categories against your live deployment.
CWE Top 25
The Common Weakness Enumeration Top 25, compiled by MITRE, identifies the most dangerous software weaknesses — the root causes that enable exploits. Where OWASP describes attack categories, CWE describes the code-level flaws that make them possible. Cross-referencing both gives us a complete picture of your app's exposure.
CVSS v3 Scoring
The Common Vulnerability Scoring System version 3 is the industry-standard severity scoring method used by the NVD (National Vulnerability Database) and CVE program. Scores run 0–10: Critical (9.0–10.0) requires immediate action, High (7.0–8.9) requires a fix this sprint, Medium (4.0–6.9) should be scheduled, Low (0.1–3.9) is tracked. Every finding in an LRC report carries a CVSS-aligned severity.
The 4 Dimensions
Every audit covers exactly these four dimensions — no more, no less.
Security
OWASP Top 10, CWE Top 25, auth flaws, secrets in deployed code, vulnerable dependencies, injection vectors, rate-limit probe.
Reliability
Error handling coverage, race conditions, missing transaction boundaries, retry logic, graceful degradation under load.
Performance
N+1 query detection, missing database indexes, JavaScript bundle bloat, synchronous blocking operations, cache strategy gaps.
Monitoring
Error tracking presence (Sentry, Datadog, etc.), alerting gaps, logging quality, uptime check coverage.
The Enhanced Stack
Beyond the four core dimensions, every scan includes:
- SSL/TLS grade — via SSL Labs methodology (A–F). Checks certificate validity, protocol version, cipher suite security, and HSTS configuration.
- HTTP security headers grade — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Missing headers are the most common misconfiguration we find.
- Open port exposure — via Shodan. Databases, admin services, and internal APIs that are reachable from the public internet when they should not be.
- Live rate limiting probe — we actively test whether your login, signup, and API endpoints enforce rate limits. We don't just check config — we test it.
- Benchmark comparison — your score compared against the average for apps on your stack (Supabase, Vercel, Render, etc.). Gives you context for where you sit relative to similar apps.
What We Don't Cover
Honesty about scope is part of our methodology. We do not audit:
- UX, accessibility, or SEO
- Legal compliance certification — SOC 2, HIPAA, GDPR. We can identify gaps and prepare you for certification, but we don't certify.
- Business logic correctness — whether your app does what it's supposed to do
- Design quality or mobile-specific issues (unless they surface as a security or performance finding)
If you need those audited, we'll tell you. We don't pretend to cover more than we do.
The URL-Based Approach
"I thought security audits required code access."
Traditional security audits do. They require a consultant to sit with your codebase for weeks and charge $15,000–$50,000. That model works for enterprise software where a full source review is genuinely required.
LRC works differently: outside-in, the same way a real attacker approaches your app. If a vulnerability is exploitable from the internet — which is the kind that matters — we find it without reading your code. Your deployed application exposes its attack surface whether or not we have source access.
This is why we can deliver a full four-dimension audit for $499 instead of $15,000, and deliver it in under 2 minutes instead of 2 weeks.
The DFY Technical Setup ($1,999 setup fee, includes Month 1 of Growth Retainer, then $2,999/mo) is our source-code-access product — a senior engineer reviews your full repository and implements the fixes. That's the right tool when you want human implementation, not just the report.
See the methodology applied to your app.
Free scan. No code access. No signup. Results in under 60 seconds.
Scan my app — free