Application Security Assessment
Understand your application’s security risks—and what to fix next.
Before launch or after changes, find out where security risks originate and what your team should address. I review your source code and relevant configuration, explain the root causes, and recommend fixes suited to your codebase.
When this helps - Before launch. After change.
- Preparing to launch?Review the implementation before introducing real users, sensitive data, or new partners. Identify concerns your team should address or investigate before release.
- Your application has changed?New features, AI tools, integrations, and infrastructure can change how the system handles access and data. Assess those changes, even if the application was tested previously.
What you receive
Know where the issue starts and how to address it.
Priorities for leadership
The important risks, potential business impact, and recommended next actions.
Evidence for engineering
Affected files and code paths, root cause, severity, confidence, and any validation still needed.
Recommendations for fixing the issue
Guidance tailored to your codebase, with suggested checks after the change. Safe reproduction or validation steps are included where possible.
Coverage and next steps
A record of what was examined, exclusions, and remaining questions, plus a discussion with your technical owner.
Your team reviews, approves, and implements changes. Hands-on remediation and follow-up verification can be scoped separately.
Assessment scope
Examine how access, data, and configuration work together.
We agree on the repositories, workflows, and configuration to review. Areas can include:
- Identity and accessLogin, sessions, account recovery, roles, and separation between users or organizations.
- Application and APIsHow requests, background jobs, and business workflows handle untrusted input.
- Sensitive dataWhere information is stored, logged, analyzed, or passed to external services. Healthcare reviews apply this lens across the assessment.
- AI featuresPrompts, conversation storage, model calls, tool permissions, and data shared with AI providers.
- Cloud and deploymentAvailable infrastructure-as-code, permissions, storage configuration, and deployment workflows.
- Integrations and dependenciesWebhooks, third-party APIs, secrets, packages, and build configuration.
How it works - I review the findings and lead the discussion.
Step 1
Agree on scope.
We discuss your stack, architecture, sensitive workflows, and previous assessments. The proposal defines coverage, deliverables, timing, price, and access requirements.
Step 2
Review the implementation.
Specialized AI-assisted reviews examine code and data flows. I independently trace every proposed Critical or High finding back through the source to confirm or challenge it. For every finding in your report, I review the evidence, severity, root cause, and recommended fix. I also inspect what was covered and what remains uncertain.
Step 3
Work through the findings.
I prioritize the findings and lead a discussion of the evidence, business impact, and any validation still needed. Your technical owner reviews the recommendations and decides how to respond.
Healthcare and AI experience
Recommendations informed by real application delivery.
I spent two years as Director of Engineering for a women’s telehealth app and now provide fractional CTO leadership for a healthcare AI platform. My work spans architecture, sensitive data, administrative access, integrations, and AWS infrastructure. I lead The Fractional Stack and do this review with you directly.
That experience helps connect a technical finding to the product, the people using it, and the team responsible for fixing it. Healthcare reviews pay particular attention to patient information; the service also applies outside healthcare.
Explore my healthcare platform experienceCommon questions
Questions before we begin.
How does this differ from a penetration test?
This assessment examines source code and relevant configuration to explain where risks originate and how to address them. Penetration testing examines behavior in a running system and may also include source access. The approaches complement each other. This engagement does not include a live penetration test or guarantee that all vulnerabilities will be found.
Does this establish HIPAA compliance?
No. It can identify technical risks in how an application handles sensitive health information. It is not a compliance certification or a complete organizational HIPAA risk analysis.
What applications can you assess?
The strongest current fit is web applications using JavaScript or TypeScript, React, Node.js, and AWS. We confirm compatibility and any adaptation during scoping. If you have an idea without code, start with a Product and Launch Blueprint.
How are price and timing determined?
After scoping the repositories, architecture, important workflows, and depth of review. The proposal defines price and timing before work begins.
How will you handle our code and data?
Before access, we agree on confidentiality, approved AI providers and other analysis tools, where code is processed, who can access the code and reports, and retention. No patient records or production credentials are needed for the initial conversation.
Do we need an engineering team?
You need a technical owner who can review findings and approve changes. That can be an internal engineer or development partner. Implementation support and ongoing Fractional CTO work can be discussed separately.
Decide where to focus your security work.
Book a 30-minute intro call to discuss what you’re building, what has changed, or what concerns you. I’ll determine whether an assessment fits and what it should cover.
Start with your stack and goals. No code upload required.