Every app has open doors.
An open door is a production failure anyone can walk through without hacking: no login, no exploit, just a door nobody locked. We find them first, prove them with evidence, and fix them so they hold.
Five open doors
The open table
Your database has a rule on every table that says who may read it. Forget it on one table, and anyone with your app's public key can read that table, or write to it.
2The secret key in the app
Some keys are public by design. Secret ones can charge cards, send email as you or open your storage, and anything shipped inside the app can be pulled out by anyone who downloads it.
3The bucket nobody locked
Photos, documents and uploads live in a storage bucket with its own rules. Old buckets get forgotten and stay open.
4The AI with the keys to production
AI agents don't just write code now; they run it. The risk isn't the agent. It's that the agent can reach production at all.
5The one that breaks on its own
Certificates now last at most 200 days, falling to 47 days by 2029. Miss one renewal and every visitor sees a full-page warning instead of your app.
Passive, written, verified
- Passive only. We read what any visitor can see. We never log in, never submit a form and never try to break anything.
- Evidence first. Every finding comes with its timestamp, status code and screenshot, seen three times at least ten minutes apart.
- Private by default. Findings about a site go only to its owner. What we publish is counts, never names.
- Fixed means verified twice. A fix is done when two later checks come back clean.
Get a free evidence report
Tell us your site's address. We run passive checks only, the same ones in our videos, and send you what we find with the evidence: timestamps, status codes, screenshots. No call, no login, no obligation.
Our inbox opens this week. Until then, message @velfoundry on Instagram with your site's address. We reply in writing.