// Deliverable

What's in your 10-page report

A single PDF, delivered within 48 hours of repo access. Every report follows the same structure so a reader can move from snapshot to evidence to terms without hunting.

01 Project Dashboard. Repo snapshot: language mix, lines of code, dependency count, scan timestamp, and the one-line risk read.
02 Section A — urgent findings. Release-blocker and before-launch issues with severity, file/line references, and CWE classification.
03 Section B — backlog sample. A representative sample of lower-priority findings with the total backlog count disclosed.
04 Methodology. How the snapshot was taken, how findings were prioritized, and what the report does and does not claim to cover.
05 Tool inventory. Exact tool versions, rule sets, and frameworks used during the scan, so any finding is reproducible.
06 Refund and credit terms. The written terms that govern the 14-day upgrade credit and the contradiction-of-source correction path.

// Scope

What we check

The scan targets the issues that actually block Apple-platform releases or quietly cost revenue post-launch.

StoreKit 2 entitlements. Transaction verification path, entitlement gating, paid-state persistence, and revenue-risk patterns.
App Privacy report consistency. Declared data collection versus what the SDKs and code actually do at runtime entry points.
ATS exceptions. NSAppTransportSecurity overrides and what each exception is masking in the network layer.
Swift Concurrency and data races. Actor isolation violations, unstructured tasks, and Sendable holes that show up under strict concurrency checking.
Force unwraps in critical paths. ! and try! on user-facing code paths, launch sequences, and payment flows.
App Review guideline risk surface. Guideline-adjacent patterns: private API surface, encryption export declarations, tracking framework usage, and rejection-prone entitlement combinations.

// Boundaries

What this is NOT

Plain about scope so the report does work the price actually covers.

Not App Review certification. Apple decides what passes review. This report sharpens the risk picture before you submit; it does not guarantee approval.
Not penetration testing. No exploit development, runtime probing, or live attack against your infrastructure.
Not a full security audit. No formal threat model, supply-chain attestation, or compliance certification.
Not a refactor proposal. Findings are evidence and prioritization, not a rewrite plan or a fixed-scope statement of work.

// Methodology

Tools and methodology

The report is produced inside an isolated Mac Mini audit account. Read-only repo access, no retention after delivery, NDA available on request.

Semgrep — custom rule packs for Swift and Objective-C anti-patterns, including StoreKit and paid-state trust boundaries.
gitleaks — secret and credential scanning across the full git history, not just HEAD.
trivy — dependency and SBOM scanning against current advisories.
swiftlint — style and correctness rules tuned for release-blocker shapes, not formatting noise.
OWASP MASVS / CWE — every Section A finding is mapped to an MASVS control or CWE identifier so severity is defensible.
Claude-assisted review — large-context AI review of architectural seams and entitlement flows, with the scan output as evidence.

// Public samples redact private implementation detail

Paid reports include exact file, line, evidence, and remediation detail for the client. Public samples redact method names, variable names, source paths, and exploit mechanics when they would expose a shipped app's private implementation.

// Credit path

Upgrade to Surface or Standard within 14 days and the Triage fee is credited toward the larger engagement.

If a Section A finding is contradicted by source as of the scan snapshot, the report terms explain the credit path: a re-rendered finding at no charge, or the full Triage fee credited toward a Surface or Standard audit booked within 14 days. One credit per engagement.

// Tiers

Where this fits

Triage is the entry point. Larger tiers open once the Triage queue is established.

Available now

Code Audit Triage

$500 · 48-hour turnaround · 10-page PDF

One app, one repo, one focused subsystem. Decision-ready written deliverable with severity, file/line references, and CWE classifications.

Continue to payment — $500

Available after first Triage clients

Surface Audit

$1,500 – $3,000

Scoped review for smaller Apple-platform codebases with per-finding human review on top of the Triage pipeline.

Available after first Triage clients

Standard Audit

$3,000 – $6,000

Broader codebase review for more complex apps and deeper release-risk read, with per-finding human review.

// Next step

Continue to payment — $500.

10-page PDF. 48-hour turnaround from repo access.

Continue to payment — $500 Read the DeckScore sample report

Questions before paying? Read the code-handling policy — read-only access, no retention, NDA available.

Apple-platform code audit, $500, 48-hour turnaround.