LTH Cybersecurity
Professional Pentesting · Flexible Pricing · Solo Apps to SOC 2
Penetration Testing for Startups & Vibe-Coded Apps
You shipped fast with Cursor, Lovable, Bolt, Replit, or Claude Code. Now find out what an attacker would find. LTH Cybersecurity provides manual web app and API penetration testing for solo developers, small teams, and early-stage startups, with a scoped quote that fits a small budget. Need a compliance-driven pentest for SOC 2 or a larger environment? We do that too.
You shipped fast. Attackers test fast too.
Professional penetration testing for indie hackers, vibe coders, small SaaS teams, agencies, and startups that do not have a security team yet, plus compliance-driven testing for growing and larger organizations.AI coding tools are very good at producing features that work. They are much less reliable at the parts nobody sees in a demo: checking that user A cannot read user B’s data, keeping API keys out of the browser, locking down Supabase or Firebase rules, and verifying that a Stripe webhook actually came from Stripe. Those gaps do not break anything during normal use. They only show up when someone goes looking for them.
Most pentesting firms are built for enterprises, with minimum engagement sizes and timelines to match. A solo founder with one app, or a three-person team about to launch, usually gets priced out or handed an automated scan with a logo on it. We do real manual testing, scoped to your app, and charge for the work your app actually needs. The same team also runs larger, compliance-driven engagements, so you will not outgrow us when SOC 2 or enterprise customers come into the picture.
We also do this work in public. Our team regularly finds and responsibly discloses vulnerabilities in real products, from security vendors to small WordPress businesses. Read about our responsible disclosure work.
What we find in vibe-coded and AI-built apps
These are the issues that show up again and again in apps built quickly by small teams and AI coding tools.
Broken access control (IDOR)
Change an ID in a request and see another user’s invoices, messages, or files. This is the most common serious bug we find, and automated scanners almost never catch it.
Open Supabase and Firebase rules
Row Level Security turned off, permissive Firestore rules, or public storage buckets that let anyone with your public key read or write the whole database.
Secrets in the frontend
Service-role keys, OpenAI or Stripe secret keys, and admin tokens bundled into JavaScript or committed to a public repository.
Unprotected API routes
Next.js API routes, server actions, and backend endpoints that check login in the UI but not on the server, plus admin routes nobody linked to but anyone can call.
Payment and webhook logic
Prices set in the browser, unverified Stripe webhooks, coupon and trial abuse, and subscription checks that can be skipped to unlock paid features for free.
AI and LLM features
Prompt injection, leaked system prompts, chatbots that reveal other users’ data, and AI agents with tool access they should not have.
Authentication flaws
Weak password reset flows, JWTs that are never verified, sessions that never expire, missing rate limits on login, and account takeover through email changes.
Injection and server-side bugs
SQL and NoSQL injection, stored XSS, server-side request forgery (SSRF) in URL fetchers and image importers, and insecure file uploads.
Pentesting options for small teams
Pick what fits your app and your stage. Every engagement is manual testing by a real person, scoped before work starts.
Launch Pentest
For solo apps and MVPs before launch or right after. A focused test of one web app and its API covering access control, authentication, secrets, database rules, and the OWASP Top 10.
- One app, core user flows
- Ideal for solo devs and vibe coders
- Plain-language report with fixes
Web App & API Pentest
For SaaS products with multiple user roles, teams or tenants, payments, and integrations. Deeper authenticated testing against OWASP testing guidance and the OWASP API Security Top 10.
- Multi-role and multi-tenant testing
- Business logic and payment abuse
- Summary you can share with customers
AI & LLM Feature Testing
For apps with chatbots, AI agents, or retrieval over user data. We test against the OWASP Top 10 for LLM Applications, including prompt injection, data leakage between users, and unsafe tool use.
- Prompt injection and jailbreaks
- Cross-user data exposure
- Agent and tool permission abuse
Network, Cloud & VPS Pentest
For the infrastructure behind your app: exposed ports and admin panels, SSH and database exposure, misconfigured cloud storage, and outdated services on your VPS or cloud account.
- External attack surface review
- VPS and server hardening findings
- Cloud storage and config checks
Retest & Fix Verification
After you fix the findings, we test again to confirm each issue is actually closed and that the fix did not open something new.
- Confirms every fix
- Updated report for your records
- Can be included in your quote
Ongoing Testing Per Release
Shipping new features every week? Test new endpoints and major changes as they go out instead of waiting for a once-a-year audit.
- Testing that keeps up with releases
- Focused on what changed
- Flexible, ongoing arrangement
Flexible pricing for solo devs and small teams
You should not need an enterprise budget to find out whether your app leaks user data. Pricing is based on what your app actually has: the number of user roles, API endpoints, and integrations, and how deep you want testing to go. You get a fixed quote before any work starts.
- No enterprise minimums. One small app is fine.
- Fixed quote before testing begins, for small apps and larger scopes alike
- Testing can be phased to match your budget and roadmap
- Verified Indigenous-owned businesses and organizations receive a 7% discount
Running your app on a Linux VPS?
A pentest shows you what is wrong today. LTH Shield helps keep your server protected afterward, built for solo developers and small server owners who want real protection without the big bill.
Compliance-driven and larger-scale pentesting
Small teams are our focus, but not our limit. We also test growing companies, regulated teams, and larger organizations that need formal, audit-ready penetration testing.
SOC 2 Penetration Testing
Working toward SOC 2 Type I or Type II, or renewing? We scope the test around your in-scope systems and what your auditor expects, then deliver a report and retest evidence you can hand straight to them.
- Scoped to your SOC 2 boundary
- Auditor-ready report and retest results
- Fits first-time and annual audits
ISO 27001, PCI DSS & Other Frameworks
Testing that supports ISO 27001 vulnerability management controls, PCI DSS penetration testing requirements, and the security clauses in enterprise contracts, cyber insurance applications, and vendor questionnaires.
- Mapped to your framework’s requirements
- Annual and post-change testing
- Evidence for customers and insurers
Internal Network & Active Directory
An assumed-breach test from inside your network: what an attacker could reach after one phished laptop, including Active Directory weaknesses, lateral movement, and paths to domain admin.
- Assumed-breach scenarios
- Active Directory attack paths
- Segmentation testing
External Network & Cloud
Your full internet-facing footprint and cloud accounts across AWS, Azure, and Google Cloud: exposed services, remote access, identity and access misconfigurations, and storage exposure.
- Full external attack surface
- AWS, Azure, and GCP configuration review
- Identity and access testing
Multi-Application Programs
Several web apps, APIs, and mobile backends across multiple teams, tested under one scoped engagement with consistent methodology and a single remediation tracker.
- Several apps and APIs in one engagement
- Consistent severity ratings across teams
- Coordinated retesting
Annual & Recurring Testing
A testing calendar that lines up with audit cycles, major releases, and infrastructure changes, so you are not scrambling for a pentest report a week before the auditor arrives.
- Planned around audit dates
- Testing after significant changes
- Year-over-year comparison
Built for auditors, still readable by developers
Compliance engagements follow recognized methodologies, including the OWASP Web Security Testing Guide, the OWASP API Security Top 10, PTES, and NIST SP 800-115, with risk ratings based on CVSS.
Reports include the scope, methodology, testing dates, an executive summary for leadership and auditors, detailed findings with reproduction steps, and a remediation section your engineers can work from. Retest results document which findings were closed, which gives auditors the evidence they look for.
Whether you are a five-person startup preparing for your first SOC 2 audit or an established organization with an annual testing requirement, you get the same manual testing and the same flexible, fixed-quote pricing.
How a pentest works
A simple process from first message to fixed app.
1. Scope and authorization
Tell us about your app and what matters most. We agree on what is in scope, the testing window, and the rules of engagement, and you sign written authorization before testing starts.
2. Manual testing
We test as an outside attacker and as each of your user roles, combining hands-on testing with tooling. Critical issues are reported to you right away instead of waiting for the final report.
3. Report and fixes
You get a clear report with severity, steps to reproduce, and fix guidance for your stack. Each fix is written so you can hand it straight to your AI coding assistant or developer.
4. Retest
Once you have made the fixes, we verify them and update the report so you have a clean record for customers, investors, or your own peace of mind.
A report you can actually fix from
A lot of pentest reports are long PDFs nobody on the engineering team reads. Ours are written for the person who has to fix the app. Every finding explains what the problem is, how we exploited it, why it matters for your users, and exactly what to change.
We give fix guidance for the stack you actually use, including Next.js, React, Supabase, Firebase, Node and Express, Python and Django, Laravel, and Rails. If you built the app with AI, you can paste a finding into Cursor, Claude, or ChatGPT and get a working patch, then let us verify it on retest.
You also get a short executive summary you can share when a customer sends a security questionnaire, an investor asks about security, or an enterprise deal requires proof of testing.
Who this is for
Built first for teams with users, data, or payments and no security team, and scaled up for organizations that need formal, compliance-driven testing.
Vibe coders and solo founders
You built the app with Cursor, Lovable, Bolt, Replit, v0, or Claude Code and it works. Before real users trust it with their data, have a professional try to break it.
Indie hackers and side projects
Your weekend project started making money. Now it holds customer emails, payment records, and API keys worth stealing.
Early-stage startups
Pre-launch, pre-raise, or answering your first enterprise security questionnaire. A pentest report is one of the first things serious buyers ask for.
Small agencies and dev shops
Shipping client apps on tight timelines. Add an independent pentest before handoff to protect your clients and your reputation.
Companies working toward SOC 2
Your first enterprise customers are asking for SOC 2 or a recent pentest report. Get testing scoped to your audit, from a team that understands both startups and auditors.
Larger and regulated organizations
Established companies, financial services, healthcare, and public-sector suppliers that need annual, framework-aligned testing across applications, networks, and cloud.
Pentesting questions
Straight answers before you reach out.
What is the difference between a penetration test and a vulnerability scan?
A scanner checks for known patterns automatically. A penetration test is a person actively trying to break your app: logging in as different users, changing IDs in requests, abusing business logic, and chaining small issues into real impact. Scanners rarely find broken access control, which is one of the most common problems in AI-built apps.
I built my app with AI. Do I really need a pentest?
If the app stores user data, takes payments, or has accounts, yes. AI coding tools are good at producing features that work, but they often skip authorization checks, leave database rules open, or put secrets in frontend code. Those issues do not show up in normal use. They show up when someone goes looking.
How much does a pentest cost?
Pricing is flexible and based on scope: how many user roles, API endpoints, and integrations your app has, and how deep you want testing to go. You get a fixed quote before any work starts. There are no enterprise minimums, and a single small app can be tested on its own.
How long does a pentest take?
Small apps usually take days of testing, not weeks. Larger environments and compliance engagements are scoped individually. Your quote includes the timeline, and we can plan around a launch date, fundraise, audit window, or customer security review.
Do you only work with small teams?
No. Small teams and solo-built apps are our main focus, but we also run larger and compliance-driven engagements for growing companies and established organizations, including multi-application testing, internal networks, Active Directory, and cloud environments.
Can your pentest be used for SOC 2, ISO 27001, or PCI DSS?
Yes. We scope compliance pentests around your framework and auditor expectations, and deliver a report with methodology, scope, risk ratings, and retest evidence. SOC 2 and ISO 27001 do not strictly mandate a penetration test, but auditors and customers commonly expect one as evidence that security controls work. PCI DSS requires internal and external penetration testing at least every 12 months and after significant changes.
Do you test production or staging?
Staging is preferred when it closely matches production. Production testing is possible with agreed rules, such as no destructive tests and set testing windows. Either way, we need written authorization from the owner of the app before testing begins.
What do I need to provide?
The app URL, a test account for each user role, and a short description of what the app does. API docs and read access to the code repository are optional but make testing faster and more thorough.
Can you retest after we fix the issues?
Yes. A retest confirms each fix actually closes the issue and did not break something else. It can be included in your quote.
Do you work with teams outside Saskatchewan?
Yes. Pentesting is done remotely. LTH Cybersecurity is based in Yorkton, Saskatchewan, and works with developers and teams across Canada and beyond. If you also need ongoing monitoring, see our managed security services.
Get a Pentest Quote
Tell us about your app or environment, and any compliance requirement. Please do not include passwords, API keys, or test credentials in this form; we will arrange those securely once the scope is agreed.