PRICING

You built fast. Here's what that actually looks like under the hood.

Not vague warnings. Specific findings with line numbers and copy-paste fixes — from an automated scan that takes 60 seconds and requires zero code access.

Run a free scan → No signup required for the free scan.

SAMPLE OUTPUT

This is what we actually find.

Every scan runs four automated tool chains against your live URL. Below is a real finding — the kind that takes a security engineer three hours to catch manually, and that our scanner surfaces in 18 seconds.

LaunchReadyCode · Scan Report · api.example.com
P1 SECURITY Semgrep · owasp:sql-injection-user-controlled
SQL injection vector in user lookup endpoint
File:/api/users.ts Line:147 Tool:Semgrep (owasp:sql-injection-user-controlled) Conf:High · scan completed in 18.3s
Description
req.query.id is concatenated directly into a SQL string without parameterization. An attacker can append OR 1=1-- to exfiltrate every row in your users table. This is exploitable by any authenticated user.
Recommended fix
− db.query(`SELECT * FROM users WHERE id=${req.query.id}`)
+ db.query('SELECT * FROM users WHERE id = ?', [req.query.id])
47
findings total
3
P0 critical
12
P1 high
18
P2 medium

The free scan shows your score and the top 3. The $499 audit gives you this for every finding — with severity, priority order, and a copy-paste fix.

WHAT WE SCAN

Four tool chains. One complete picture.

We run automated checks across security, reliability, performance, and monitoring. Every time. Every plan.

Security
Semgrep  /  Snyk  /  gitleaks  /  trivy
Checks
  • OWASP Top 10 and CWE Top 25
  • Auth flaws and broken access control
  • Secrets and API keys in source code
  • Vulnerable dependencies with known CVEs
  • Injection vectors (SQL, command, XSS)
Example finds
  • SQL injection in user lookup endpoint
  • Missing Content-Security-Policy headers across all routes
  • Exposed API key committed to source, live in history
  • lodash 4.17.15 — prototype pollution (CVE-2021-23337)
  • Broken auth flow — password reset token not invalidated after use
Reliability
ESLint custom rules  /  ruff  /  custom AST checks
Checks
  • Error handling gaps in async code
  • Race conditions and shared state
  • Transaction boundaries and rollback coverage
  • Retry logic on external service calls
  • Graceful degradation under dependency failure
Example finds
  • Unhandled promise rejection in /api/orders — crashes the process
  • No retry on Stripe API call — one network blip fails every payment
  • Missing transaction rollback — partial writes leave corrupted state
  • Uncaught exception in async route handler — no 500 response to client
Performance
Lighthouse  /  k6  /  EXPLAIN ANALYZE  /  custom DB profilers
Checks
  • N+1 query patterns
  • Missing database indexes on common query paths
  • JavaScript bundle bloat
  • Synchronous blocking in async request handlers
  • Cache strategy gaps on hot endpoints
Example finds
  • 50 DB queries per page load — should be 2 with a join
  • 4 MB uncompressed JS bundle — no code splitting, no tree shaking
  • Sync file read in request path — blocks event loop under any load
  • No pagination on list endpoints returning 10,000+ rows
Monitoring
Custom probes for Sentry / Datadog / New Relic  /  log pattern analysis
Checks
  • Error tracking SDK presence and configuration
  • Alerting coverage on critical paths
  • Logging quality (structured vs. plain strings)
  • Uptime monitoring on auth, payments, and health endpoints
Example finds
  • No error tracking — you find out about production crashes from users
  • No alerting on payment failures — silent revenue loss
  • Unstructured logging — plain strings, unsearchable at scale
  • No uptime monitoring on /auth and /api/checkout
What automated scanning covers — and where it stops.

Our scanner catches the vulnerabilities that appear in every codebase and that automated tools reliably detect: OWASP Top 10, CWE Top 25, secrets in code, vulnerable dependencies, missing security headers, RLS gaps, rate-limit absence, and Core Web Vitals. That is roughly 80% of what an expert would look for in the first pass.

What no URL-based automated tool can catch: business logic flaws (auth bypass specific to how your app works), penetration test findings (a human red team exploiting your live app), and compliance certification (SOC 2, HIPAA, GDPR require a human auditor — we can prep you, we do not certify). We do not cover UX, accessibility, or SEO.

A perfect score on our scan means you have eliminated the 80% that sinks most apps. The remaining 20% requires a human engineer reading your actual code. That is what Code Care is for.

PLANS

Pick your starting point.

Start with the free scan. Move up when the findings warrant it.

One-time — no recurring charge
ALWAYS FREE
Free Scan
$0
No credit card. No signup.
Who this is forAny founder who wants to know where they stand before spending anything.
What you get
  • Launch Readiness Score: 0–100, broken down by dimension
  • Top 3 findings surfaced across highest-severity dimensions
  • All 4 tool chains run against your live URL
  • Results in under 60 seconds

This is not a full finding list. Use it to decide whether the $499 audit is worth it.

Scan my app — free

No account needed · Instant results · OWASP-standard scan

MOST POPULAR
Launch Readiness Audit Report
$499 one-time
Delivered in under 2 minutes.
Who this is forFounders who just shipped v1 and want to know exactly what to fix before they scale, hire, or fundraise. The definitive diagnostic — exclusive deliverables not available on any subscription tier.
What you get
  • Every finding across all 4 dimensions — typically 20–80 per app
  • Severity classification: P0 critical, P1 high, P2 medium, P3 low
  • Plain-English description + copy-paste recommended fix for every finding
  • Branded PDF report — shareable with investors, co-founders, or your board
  • Benchmark comparison — where your score stands against 200+ apps we've audited
  • Prioritized fix roadmap — ordered by severity with estimated time per issue
  • Senior AI review (Opus) — every finding reviewed by our most capable model before delivery
  • Embeddable Launch Ready badge — displays your /100 score publicly

Delivered in under 2 minutes · 30-day re-scan guarantee · OWASP-standard methodology

Continuous Monitoring — Tier 1 (Launch Ready)
Automated scans, no code access. Results delivered to your inbox.
Starter
$149/mo
Billed annually: $134/mo ($1,608/yr)
Who this is forTeams shipping multiple times a week who need regression alerts without manually re-scanning. Best started after you've completed your Launch Readiness Audit Report — so you know exactly what you're monitoring.
What happens
  • Your URL scanned daily at 06:00 UTC across all 4 tool chains
  • Weekly digest email: new findings, fixed issues, score trend
  • Subscriber dashboard: score history, finding trend chart, dimension breakdown
  • Embeddable badge that updates automatically

30-day cancel notice · No contract · OWASP-standard scanning

BUILDER
Builder
$249/mo
Billed annually: $224/mo ($2,688/yr)
Who this is forFounders who ship daily and need to know about a regression the next morning, not the next Monday.
What's different from Starter
  • Daily digest — new findings surface the morning after they appear
  • Up to 50 advisory PR reviews per month
  • P0 and P1 findings broken out at the top of every digest
  • Score trend history and charting

30-day cancel notice · Advisory PR reviews via Fractional CTO · No contract

RECOMMENDED
Pro
$599/mo
Billed annually: $539/mo ($6,468/yr)
Who this is forFounders with paying users or investors, where a P0 undiscovered for even 4 hours creates real risk — and who want complete visibility, not just a report in their inbox.
Pro exclusive
Error tracking and alerting — configured for you in Month 1.
We wire up error tracking and real-time alerting on your behalf. Every crash, payment failure, and outage is captured and sent to you the moment it happens. No other plan in this tier does this.
The complete visibility stack
  • Error tracking and alerting configured for you — set up in Month 1, included. Crashes flagged when they happen. Outages detected in under 30 seconds. Critical user flows checked every 5 minutes.
  • Named Fractional CTO assigned to your account
  • Real-time security alerts the moment something changes
  • Up to 150 advisory PR reviews per month
  • Daily platform-aware security scans across all 4 dimensions
  • P0 alerts (crashes, payment failures, auth broken) to your phone within 15 minutes
  • Weekly error digest + monthly health report
  • 30-day cancellation notice

Named CTO included · Real-time alerts · Error monitoring setup in Month 1 · 30-day cancel notice

If your app generates revenue

A perfect scan score is not the finish line.

Our scanner eliminates the 80% of vulnerabilities that automation reliably finds. At $10,000/month in revenue, a breach is not a $499 problem — it is a customer refund problem, a churn problem, and a reputation problem that takes months to rebuild. The 20% that automated tools cannot see requires a senior engineer reading your actual codebase. A one-time DFY Technical Setup costs $1,999 and covers everything our scanner cannot: business logic review, manual auth hardening, infrastructure hardening, and a 45-minute handoff call — implemented as PRs you approve before anything ships.

DFY Technical Setup
$1,999
one-time · then $2,999/mo
Code Care — Tier 2 (Human-delivered)
Code Care is human-delivered.

Every deliverable is reviewed and signed off by a Fractional CTO before it reaches you. These products involve real engineering work — not just reports.

ONBOARDING
DFY Technical Setup
$1,999 setup fee
Includes Month 1 of Growth Retainer — then $2,999/mo
Who this is forFounders who built with Lovable, Bolt, or Cursor and want the entire 20% implemented for them — then want a named CTO watching the codebase every month after.
What's included
  1. Full codebase review — your senior engineer reads every file and maps every gap AI didn't configure
  2. Implementation: auth hardening, database row-level security, API security, rate limiting, HTTP security headers, error tracking wired, monitoring setup, secrets moved out of code, environment configuration
  3. Every change opened as a PR — you review and approve before anything merges. Nothing ever goes to production without your sign-off.
  4. One 45-min handoff call — walk through every change, ask anything, confirm you understand what was done and why
  5. Month 1 of Growth Retainer included: daily scans, dedicated Fractional CTO, weekly 30-min sync, P0 escalation within 4 hours. Continues at $2,999/mo from Month 2 — cancel any time before Month 2 to stop.
Timeline: 5–7 business days · The complete 80% → 100% implementation · then ongoing CTO partnership

PR-based delivery · You approve every change · Human CTO review · Cancel before Month 2 to stop retainer

Growth Retainer
$2,999/mo
Billed annually: $2,699/mo
Who this is forPost-launch startups that want a technical co-pilot watching the app and contributing to the codebase — without the overhead of a full-time CTO hire.
What you get each month
  • Daily automated scans + unlimited advisory PR reviews
  • Dedicated Fractional CTO for async Q&A, architecture decisions, code review
  • Weekly 30-minute sync call
  • P0 findings escalated within 4 hours
  • Monthly technical health report

This is not a full-time engineer. Senior technical oversight for a team of 1–5 without an in-house CTO.

Scale Retainer
$4,999/mo
Billed annually: $4,499/mo
Who this is forGrowth-stage companies where engineering quality is a board-level concern and a security incident would make the news.
Everything in Growth, plus
  • Named Account Manager for business escalation
  • On-demand scans triggered via webhook — on every deploy, not just daily
  • SLA: P0 findings within 2 hours. 99.9% scan platform uptime.
  • Quarterly architecture review and roadmap input
  • Priority access to beta tools

COMPARE PLANS

All plans at a glance.

Audit
$499		 Starter
$149/mo		 Builder
$249/mo		 Pro
$599/mo		 DFY Setup
$1,999 + $2,999/mo		 Growth
$2,999/mo		 Scale
$4,999/mo
Daily scans — ✓ ✓ ✓ Setup + M1 incl. ✓ ✓
Digest One-time report Weekly Daily Real-time Real-time (M1+) Real-time Real-time
PR advisory reviews — — 50/mo 150/mo Included Unlimited Unlimited
Named CTO — — — ✓ For review call ✓ ✓
Named Account Manager — — — — — — ✓
P0 response time In report Next digest Next digest < 4 hours In PR < 4 hours < 2 hours
Error tracking & alerting setup — — — ✓ Month 1 — — —
Human sign-off on deliverables — — — — ✓ ✓ ✓

— COMPLIANCE WING —

Make sure your app is legally allowed to operate.

GDPR, EU AI Act, and SOC 2 foundations. Technical assessment, human implementation, and legal certification. The only compliance service built specifically for AI-powered apps.

Compliance Score
$799 one-time
Who this is for Founders who need to know where they stand on GDPR, EU AI Act Article 52, and SOC 2 — without hiring a law firm.
What's included
  • 52 automated compliance checks across GDPR, EU AI Act, SOC 2 Foundations, and ISO 27001 Foundations
  • AI analysis of your privacy policy — 8 checks
  • Compliance Report PDF — branded, dated, shareable
  • Fix Roadmap with time estimates per item
  • Template Document Pack: DPA, ROPA, cookie policy, breach notification procedure
  • Self-assessment questionnaire (5 questions)
  • $799 credited toward DFY Compliance Setup
Check my compliance — $799

Delivered in under 3 minutes · No legal firm needed to start

Compliance Monitoring
$399 /mo
Who this is for Founders who want ongoing assurance that their compliance posture hasn't drifted — and a Compliance Certificate to share with enterprise customers and investors.
What you get each month
  • Monthly re-scan across all 52 compliance checks
  • Real-time drift alerts — if something that was passing starts failing, you know immediately
  • Quarterly Compliance Certificate PDF — dated, shareable with enterprise customers
  • Monthly regulatory briefing — relevant GDPR and EU AI Act updates

Month-to-month · 30-day cancel notice

MOST COMPLETE
DFY Compliance Setup
$2,999 one-time
Includes Compliance Score ($799 value) · then $399/mo from Month 2
Who this is for Founders who want everything implemented — not just a report. Our CTO does the work, issues your Compliance Certificate, and monitors ongoing.
What's included
  1. Full Compliance Score assessment (included, $799 value)
  2. CTO implements: consent logging, data deletion flows, cookie management, DSAR endpoint, ROPA document, policy document finalisation
  3. All changes delivered as PRs — you review and approve before anything merges
  4. Compliance Certificate issued and dated
  5. 45-minute handoff call — walk through every change
  6. Compliance Monitoring ($399/mo) auto-activates from Month 2

PR-based delivery · CTO review · Certificate included · Cancel before Month 2 to stop monitoring

COMING SOON
Compliance Enterprise
Price to be announced

Everything in DFY Compliance Setup — plus legal partner review of all implementations, a formal legal opinion letter from a qualified data protection solicitor, and 12 months of Compliance Monitoring included. For founders who need a legally-certified compliance posture.

Scope: Compliance products cover automated technical checks and AI policy analysis. They do not constitute legal advice or legal certification. Launch Ready Code is not a law firm. Implementing our recommendations puts you in a strong technical compliance posture — we document every step. For CTO-implemented fixes and a Technical Implementation Certificate, see DFY Compliance Setup. For solicitor review, join the Compliance Enterprise waitlist.

See the full Compliance Wing with detailed pricing →

FAQ

Questions before you commit.

What's included in the free scan vs. the paid audit?
The free scan runs all four tool chains and gives you a Launch Readiness Score out of 100, plus the top 3 findings by severity. The $499 audit gives you every finding across all dimensions — typically 20–80 — each with a severity classification, a plain-English explanation, and a copy-paste recommended fix. The audit is the full picture. The free scan tells you whether the full picture is worth looking at.
Do you need access to our code or repository?
No. Tier 1 scans (Free, Audit, Starter, Builder, Pro) run entirely against your live URL. We never touch your source code, your GitHub, or your credentials. Tier 2 (DFY Technical Setup, Growth Retainer, Scale Retainer) involves a Fractional CTO opening a PR against your GitHub repo — for that, we use a GitHub App with read/write access you grant, scoped only to the specific repository.
What kinds of apps and sites do you scan?
Any SaaS app, website, or web application with a live URL. We scan the publicly accessible surface (and authenticated surfaces where session tokens are provided). We work best with apps built on Node.js, Python, and standard web stacks. Mobile-specific issues (iOS/Android native) are outside scope unless they surface as security or performance issues in a shared API backend.
What's the difference between Tier 1 and Tier 2?
Tier 1 (Launch Ready) is fully automated. Scans run, findings are generated, reports and digests are delivered — no human in the loop. Tier 2 (Code Care) involves a real Fractional CTO who reviews every finding, signs off on every deliverable, and — for DFY and retainers — writes and opens pull requests in your codebase. You pay more for Tier 2 because a senior engineer is accountable for the output, not just the algorithm.
What happens if my score drops after I subscribe?
That's exactly what the subscription is for. If a new P0 appears, Builder and Pro subscribers get alerted in their next digest (or within 4 hours for Pro). Growth and Scale retainer customers get a direct escalation to their assigned CTO. If we miss a P0 within our stated SLO, you receive a 10% monthly fee credit automatically. Missed daily digests for more than 24 hours also trigger a credit.
I scored 100/100. Does that mean my app is completely secure?
A perfect score means your app has passed every check our automated scanner can reliably run — OWASP Top 10, CWE Top 25, secrets detection, dependency vulnerabilities, security headers, rate limiting, RLS configuration, and Core Web Vitals. That is genuinely significant. The majority of apps we scan never reach it.

What a perfect score does not mean: that a human penetration tester would find nothing, that your business logic has no exploitable flaws, or that you are ready for SOC 2, HIPAA, or GDPR certification. These require a human engineer reading your actual source code — something a URL-based scanner cannot do.

If your app handles payments, stores sensitive user data, or is generating revenue you cannot afford to lose, a perfect automated score is the starting point — not the finish line. Code Care is the next step: a Fractional CTO reads your codebase, implements the hardening our scanner cannot see, and stays on call as you scale.
Is this a real security audit?
It is a rigorous automated scan using the same tools security engineers use manually — Semgrep, Snyk, gitleaks, trivy. It is not a penetration test conducted by a human red team, and it does not certify you for SOC 2, HIPAA, or GDPR. What it does: surface the most common, most exploitable vulnerabilities in your stack in under 2 minutes, with specific file locations and fixes. Most of our audit customers say they discovered issues they had no idea existed. If you need a penetration test or a compliance certification, we can refer you to the right firm — but start here first.

Your score is live right now.

Every app we have scanned has had at least 8 findings. Most have over 30. The free scan takes 60 seconds and requires no signup.

Run the free scan →