Built in a weekend.
Armored by default?

Each one is a tutorial
default.

• NEXT_PUBLIC_* on a service-role key → full database, client-side
• Row Level Security off, because the demo wouldn't render without it
• Auth in middleware, not in the handler
• Server actions exported with no authz check — each one is a POST endpoint
• Webhooks accepted without signature verification
• .env in the repo, source maps shipped to prod
• No rate limit on auth, no ceiling on the AI endpoint

This used to be a three-week job.

A hedged model returns
documentation.

• Ask for a payload and you get prose describing one, then a caveat
• Capability arrives behind a permission prompt, mid-run
• One context window, one thread — four hundred probes don't fit
• Nothing persists between runs, so nothing accumulates

A subscription is not
a harness.

And manual review can't
cover this hourly.

A good reviewer finds an IDOR in a week. The bugs in slide 3 all live on the wire — a header, a response body, an exported function, a rule nobody wrote. None of it shows up by clicking around, and nothing re-checks it after the deploy that reintroduces it.

Named classes. Each reachable
with an anon key.

Apps that hold money
lose differently.

You don't get hit for a database dump. You get hit for the part that moves value:

• Redeem a credit code 40 times in parallel before the balance write lands
• Forge a "paid" webhook — mark an invoice settled without paying it
• Fire the withdraw endpoint twice inside the same second
• Replay a price after it's already moved
• Pull the raw data endpoints and mirror the dataset

Your most expensive endpoint
is the one that talks back.

You shipped a chat feature. It holds an API key, bills per call, reads whatever it's handed, and in most builds calls tools on a service credential. That's not a feature with a vulnerability — that's an authenticated deputy.

• Injection that drains a balance instead of stealing a record
• A tool scoped wider than the person typing at it
• No ceiling, so the bill is the blast radius

Up to five thousand agents,
five jobs

• Recon — enumerate what's public that shouldn't be
• Authz — every route, as the wrong user, every role
• Secrets — bundle, headers, repo history, error text
• Inputs — parameters, uploads, webhooks, races
• Triage — one pass ranking by exploitability, deduped

One thousand agents, one full run. $0.33/M in · $1.32/M out · $0.01/M cached.

Inference only. Orchestration, sandboxes and human triage are the rest — and still round to nothing beside a contract.

Linear. Humans aren't.

Testing the whole surface costs less than the coffee you drink doing it.

The cheap outcome is
still expensive.

One is an audit.
The other is a heartbeat.

Twelve controls. No shopping list.

• Deny-by-default rules on every table, not just the sensitive ones
• Authz decided in the handler, per route, per role
• Service keys server-only, scoped, rotated
• Signed webhooks and idempotency keys on every money path
• Rate limit and bot mitigation ahead of the app
• CSP, HSTS, strict CORS allowlist
• Egress allowlist from the app tier
• LLM: tool scoping, injection boundary, hard budget ceiling
• Pinned dependencies, secret scanning, SAST gate in CI
• Backups with a restore you've actually tested
• Alerts on auth-failure and spend anomalies, not just 5xx
• Re-run cadence bound to deploys, not to a calendar

Find. Close. Hold.

• Days 1–7 — find and rank everything. You get the list, not a 60-page PDF.
• Weeks 2–4 — close the top of it, in order of what actually gets robbed.
• Ongoing — deploy gates, scheduled re-runs, someone reachable at 2am.

I've run the things
that get attacked.

• monster.bet — a real-money marketplace with live pricing and an AI copilot. Built it alone, zero to one: Rust API, 70+ endpoints, WebSocket streaming, Next.js app at 270+ components, 50+ live data feeds.
• Money on the wire — exchange market-making in Rust. Continuously quotes prices, rechecks the book before every trade, caps total exposure, prevents duplicate orders under a race, signs every quote, logs everything.
• Custody, not CRUD — pipeline that opens user wallets, syncs spending allowances, signs and reconciles orders under real-time risk checks. Money moves, and the code owns it.
• 100+ services running 24/7. I know what breaks at 3am because I've been paged for it.

Public, verifiable,
not self-reported.

• WIRED, September 2025 — profiled for AI agents running in production at consumer scale
• 25,000 users on Classroom AI, shipped solo post-ChatGPT
• Open-model serving — vLLM, SGLang, llama.cpp, EXL3, speculative decoding, multi-GPU TP4
• Self-hosted ClickHouse + Postgres/Supabase at production volume
• Full stack down to Rust and up to React — no handoff gap to blame

Most security people can't build.
Most builders can't break.

You don't need a report shipped from a firm that will hand you a Jira board and leave. You need someone who can find it, fix it in the codebase he already understands, and set the gate so it stays fixed. Same person, both directions.

Day seven you have a ranked list of everything a swarm found, the first tranche already closed, and a written diff. Then we decide whether you sleep better.

carsonszeder.com