siege21.
Independent AI code auditsBased in the UK. Working remotely.

Good ideas.
Solid software.

AI got you started.
Let’s get you ready for the real world.

I’m Antony Doyle. I review AI-written code for security and privacy risks before launch. I check who can access customer data, where it goes and how it’s protected, then give you findings and a prioritised plan for the fixes.

Explore security and privacy checks
↓

01 / Before launch

Follow the customer data.

Your app may work exactly as expected in a demo. A review checks what happens when someone requests another customer’s record, a credential reaches the browser or personal information is copied to a log.

  1. 01 / Access

    Who can see it?

    Sign-in, account roles, shared links and the checks that keep customers’ records separate.

  2. 02 / Movement

    Where does it go?

    Databases, file storage, logs, analytics and the external services receiving personal data.

  3. 03 / Lifetime

    What stays behind?

    Retention settings and what happens to stored copies when a record or account is deleted.

See the security and privacy checks

Sample report / Fictional application

See what a finding looks like.

A finding should explain the problem, who it affects and how to check the fix. This example comes from the Siege21 sample report.

All details are fictional. No real application was reviewed and no tests were run for this sample.

Download the sample report

PDF · 6 pages · 41 KB · No email required

E-001 / Illustrative findingHigh · Before release

Documents can be read across workspaces.

The example app checks that a user is signed in, but misses the check that they belong to the document’s workspace.

Consequence
A signed-in user who obtains another workspace’s document ID can read its contents.
Example evidence
An account from Workspace A requests a Workspace B document. The fictional result is that the document is returned.
Recommended fix and verification

Fix

Check workspace membership and document permissions before returning metadata or file contents. Apply the same checks to previews and downloads.

Verify

Requests from another workspace return no document content. Authorised reads, previews and downloads still work.

Adapted from sample finding E-001, page 4. Severity is illustrative; confidence was not assessed.

02 / Your report

A work list your developers can use.

I explain the consequence of each issue and why it has its priority. Reproduced problems are distinguished from concerns found by reading the code.

  • A summary of the decision the review supports
  • Findings tied to the reviewed version and evidence
  • Recommended fixes and checks to verify them
  • Unexamined areas and questions still to resolve

We walk through the findings together. Your team can carry out the repairs, or you can ask me to quote for them.

03 / Your reviewer

18+YEARS IN SOFTWARE

You talk to the person
who does the work.

I carry out the audit myself, from our first conversation to the walkthrough of the findings. You can ask me how I reached a conclusion and what I would do about it.

I’ve spent more than 18 years building web products, backend services and APIs. I’ll explain which problems need attention now, what can wait and what I haven’t been able to verify.

A little more about me

04 / Choose the scope

Two ways to review your app.

Focus on security and privacy, or include the checks needed to operate and recover the service after launch.

01 / Customer data & access

Security & privacy review

For an app that is about to handle customer accounts, documents or other personal information.

  • Sign-in, permissions and separation between customers
  • Credentials, exposed data and dependency risks
  • Data collection, sharing, retention and deletion

You receive An assessment of the agreed workflows, findings with evidence, a repair plan and a walkthrough.

Explore the checks

02 / A broader release decision

Launch readiness review

For an app that also needs checking for day-to-day operation, failed requests and recovery.

  • The security and privacy checks agreed for your app
  • Deployment, integrations and failure handling
  • Backups, recovery, monitoring and release tests

You receive The review findings and repair plan, plus a launch assessment identifying blockers and unverified areas.

Explore launch readiness

Both reviews are scoped to named workflows, repositories and environments. I confirm the fee, timing and any recheck in the proposal. Repairs are quoted separately.

05 / Getting started

Start with your launch plans.

Tell me what the app does, what data it handles and when you want people to use it. You don’t need a technical specification.

06 / Field notes

All notes

Planning your first release?

The production-readiness guide walks through permissions, failure, recovery and the decision to let customers depend on an app.

Read the launch guide

Security and privacy for your AI-built app

Ready for
a review?

Tell me what data your app handles and when you plan to launch.contact@siege21.com