01minutes
Code ships faster than it is secured.
An AI assistant generates a working feature in minutes. The auth check it skipped, the query it left open, the secret it hardcoded · those ship at the same speed. Velocity is the new attack surface.
Maru Systems · the security practice
Built at AI speed.Audited like an adversary.
Every build we ship carries a written security audit. We also run that assessment on its own, against software we did not write. A 136-control methodology aligned to OWASP, tested by hand rather than by scanner, delivered as a report precise enough for your engineers to close every finding and credible enough for your customers and insurers.
The problem
The software is shipping.
The security is not keeping up.
We are living through the fastest change in how software gets built in a generation. That is a good thing. It is also a security problem that almost nobody is positioned to catch, because the tooling that writes the code does not stop to ask whether it is safe.
02#1
Access control is where it breaks.
Broken access control is the number one category in the OWASP Top 10. One object ID swapped in a URL, one missing tenant check, and one customer is reading another's data. It rarely shows up in a demo. It always shows up in a breach.
03$0
Nobody is checking.
Solo founders and lean teams ship to real users with no second set of eyes. Established teams move too fast to slow down for security. The gap between live and reviewed is exactly where incidents are born.
Coverage
136 controls.
Nothing waved through.
This is the actual methodology, not a marketing list. Sixteen phases run in order, every control tested and recorded with a pass, a fail, or a documented reason it does not apply. The two phases marked live are where most real breaches begin.
00
8
Engagement & Authorization
Signed scope, rules of engagement, data handling. No test runs without it.
01
10
Recon & Info Gathering
Subdomains, exposed files, leaked secrets, the full attack surface mapped.
02
11
Configuration & Deployment
TLS, security headers, cookies, CORS, source maps, preview exposure.
03
11
Authentication
Brute force, MFA bypass, password reset, OAuth, JWT forgery.
04
6
Session Management
Token entropy, fixation, logout invalidation, CSRF.
05
13
Authorization & Access Control
IDOR, privilege escalation, multi-tenant isolation, row-level access rules.
06
16
Input Validation & Injection
SQL, XSS, SSRF, command, template, path traversal, prototype pollution.
07
9
API & Backend
Rate limiting, BOLA, excessive data exposure, webhook verification.
08
8
Business Logic
Price tampering, race conditions, workflow bypass, refund abuse.
09
6
Client-Side
DOM XSS, clickjacking, secrets in the bundle, postMessage origins.
10
7
File Upload & Storage
Webshells, SVG XSS, traversal, signed-URL scope, metadata leakage.
11
7
Crypto & Data Protection
Password hashing, secrets in git, weak algorithms, data at rest.
12
7
Payments
Webhook signatures, price authority, entitlement, idempotency, PCI scope.
13
7
Infrastructure & Cloud
Env var exposure, cron auth, edge bypass, WAF, monitoring.
14
4
Dependencies & Supply Chain
Known CVEs, outdated frameworks, lockfile integrity, third-party scripts.
15
6
Reporting & Remediation
Reproducible findings, CVSS, business impact, remediation, retest.
highest-risk phase16 phases · 136 controls · manual + tooledaligned to OWASP WSTG · Top 10 · API Top 10
The deliverable
What one
finding
looks like.
No vague scanner output. Every finding in the report is written so an engineer who has never met us can reproduce it, understand the business risk, and close it. This is one of them.
▸ Reproduction steps and raw request / response are included in the full report and redacted here.
MARU-0007
CriticalCross-tenant data access via object ID
- Severity
- Critical · CVSS 9.1
- Class
- A01 Broken Access Control · IDOR / BOLA
- Endpoint
- GET /api/orders/:id
- Environment
- Production
Impact
Any authenticated customer can read another customer's orders, including names, addresses, line items, and totals, by changing the numeric ID in the request. This is a confidentiality breach affecting every tenant on the platform and is directly reportable under most privacy regimes.
Evidence
A token issued to tenant_a returned order records owned by tenant_b. The endpoint authenticates the user but never checks that the requested order belongs to them.
Remediation
Scope the query by the authenticated tenant rather than the URL parameter, and enforce it at the database with a row-level security policy: USING (tenant_id = auth.tenant()). Apply the same object-ownership check to every /api/:id route, not just this one.
The report
A document your
team can act on.
The audit is only as good as what you can do with it. Every engagement ends with a structured report built to be handed straight to your engineers, and a summary built to be handed straight to whoever needs assurance.
Executive summary
One page. Overall posture, the top risks in plain business language, and what to fix first. The page your buyer, board, or insurer reads.
Findings register
Every issue, ranked worst-first, each with reproduction steps, evidence, affected endpoints, and a CVSS score.
Remediation guidance
Exactly how your engineers close each finding, with the specific fix and code or config example. Written to be actioned, not admired.
Retest & verification
After your team fixes, we re-run the affected controls and mark each finding verified-fixed, so you have proof it is actually closed.
Severity model
Every finding is rated by real impact and scored with CVSS 3.1, so you triage by risk, not by guesswork.
- Critical
Full compromise: RCE, auth bypass, cross-tenant access, payment forgery.
- High
Account takeover, stored XSS, IDOR, secret exposure. Fix before release.
- Medium
CSRF, weak config, info leak, missing rate limits. Should fix.
- Low
Minor hardening: missing headers, verbose errors, metadata leak.
- Info
Observation or process note. No direct exploit.
Sample report
See exactly
what you get.
The audit is only as good as the report it produces. So here is a full one. This is a complete, redacted sample assessment against a fictional health platform, the exact deliverable your engineers would receive, down to the severity scoring and remediation.
- ▸Executive summary written for the CTO, not the console
- ▸Every finding scored with CVSS 3.1 and ranked worst-first
- ▸Business impact in plain language, plus exact remediation
- ▸Methodology, severity model, and a retest commitment
Download the Sample ReportPDF · 21 pages · no email required
Independence
We assess.
Your team fixes.
We do not touch your codebase, and that is deliberate. The auditor who also writes the patch has a reason to look the other way. Staying strictly third-party means our only job is to tell you the truth about your security, and our report carries the weight of a genuinely independent assessment.
No conflict of interest
We are paid to find problems, not to minimize the work of fixing them. The incentive points one way: at the truth.
Your code stays yours
We never commit, deploy, or alter a line. You keep full control and a clean separation of duties.
A verdict others trust
An independent report is what an enterprise customer, a partner, or a cyber-insurer will actually accept.
Method
How an engagement actually runs.
I.Scope & authorize
Nothing happens without a signature.
We agree the targets, the rules of engagement, and the test window in writing. A signed authorization is the first artifact of every engagement. No permission, no testing, ever.
II.Map
We learn the application before we attack it.
Recon the full surface: subdomains, endpoints, inputs, integrations, exposed files. You cannot test what you have not mapped, so we map all of it first.
III.Test like an adversary
Manual testing, not a scanner left running.
We work the 136-control methodology by hand, the way a real attacker would: chaining small flaws into real impact, probing the logic a scanner can never understand.
IV.Validate
Every finding is proven before it is written.
We reproduce each issue and discard anything we cannot demonstrate. A confident false positive wastes your engineers' time and costs us your trust. Only confirmed findings make the report.
V.Report
We hand it to you. You stay in control.
A structured report with an executive summary, prioritized findings, CVSS scores, and exact remediation guidance. Your team fixes on your timeline, in your codebase.
VI.Retest
We confirm it is actually closed.
After remediation we re-run the affected controls and mark each finding verified-fixed, so you finish with proof, not a hope that the patch worked.
Intelligence
The adversary’s eye.
Turned on who you trust.
The same forensic discipline as our security work, pointed at the people and companies behind a deal. Open-source intelligence and due diligence: every claim sourced and confidence-graded, every gap disclosed, nothing overstated.
01
Counterparty & Partner
Before you sign with a partner, distributor, supplier, or operator: who they actually are, assembled from the public record.
- ✓Corporate network & beneficial ownership
- ✓Litigation & regulatory history
- ✓Adverse media, local-language
- ✓Sanctions & PEP exposure
02Most requested
Deal & investor diligence
Pre-Transaction
Reputational and integrity diligence on a target, investor, or acquirer before a deal closes, structured as a decision-support brief a board can act on.
- ✓Source-of-wealth & red-flag review
- ✓Offshore & entity mapping
- ✓Cross-border adverse findings
- ✓Risk matrix & recommendation
03
Executive & Vendor
Background and reputational research on a senior hire or a critical vendor, drawn strictly from public and authorized sources.
- ✓Professional & corporate record
- ✓Verified digital footprint
- ✓Integrity & conflict signals
- ✓Confidence-graded findings
See the full capability
▸ Public and authorized sources only. Every finding graded and sourced · reported matters flagged as allegations, never conclusions.
Accepting engagements
Request
an audit.
Tell us what you have built and where it lives. We reply within one business day with a scope, a timeline, and a price. The first step is always a short conversation, never a scan.
Direct
security@marusystems.devCoverage
Serving companies across the United States
▸ No testing of any kind begins until a written authorization and scope are signed by the system owner.