What does a security review of an AI-built app cost?

Matt Turley, Continuum. Updated November 5, 2026.

The three levels of review, what each one finds, and how to pick the cheapest one that answers your question.

The short answer

What does a security review of an AI-built app cost?

It depends on what you are buying: a free automated scan, a written human read of the code, or a review plus fixes. Ours run free for the Leak Check, $299 for a written read, and $4,000 to $15,000 when the problems also need fixing, quoted fixed before work starts.

The three levels, and what each one is for

An automated scan. Free to cheap, minutes, and it looks only from the outside: reachability, secrets in the browser code, obvious data exposure. Good first filter.
A written human read of the code. A person opens the repository, the database rules and the hosting setup, and tells you in plain words what is wrong and what it puts at risk. This is the level that catches business-rule and permission mistakes.
Review plus fixes. The same read followed by the repairs, which is where most of the cost sits, because fixing is slower than finding.

What we charge

These come straight from the price list. The Leak Check is free. A Ship Check is $299. Ship Fix is $4,000 to $15,000, quoted fixed once the app has been read, and none of it is hourly. If you also want someone to watch it after launch, Keep it running is $500/mo.

How to pick the level you need

Start with the free scan. If it finds something, or if the app takes money or holds customer details, buy the written read next so you know what you are dealing with before you commit to repairs. Skip straight to a fix only when you already know what is broken.

Whoever you hire, ask for the result in writing, with each finding ranked and a way to confirm it is fixed. A review that ends in a call and no document is hard to act on and hard to hand to the next developer.

What a cheap review usually leaves out

A very low price generally means a scanner run with no one reading the output. Scanners miss permission mistakes, because those depend on what your app is supposed to allow, which only a person who understands your business can judge.

Want a free read on your own app?

Paste your live URL and seven automated checks run in about a minute with no signup: reachability, SSL, sign-in, the payment path, secrets in the browser code, broken links and speed. It is a surface scan, not a full audit.

Run the free Leak Check. Or book a call and talk it through.

Book a call →See all services and prices →

FAQ

Straight answers

Is there a free way to start?

Yes. The Leak Check runs seven automated checks on a live URL with no signup, and the is-it-safe-to-ship check sends back one specific finding. Both are previews, useful as a first filter and not a full review.

Why is a human read worth paying for over a scanner?

Scanners see what is visible from outside. A person can read how your app decides who may see what, find the admin route nobody protected, and spot a payment path that can double-charge. Those are the costly mistakes.

Do you charge by the hour?

No. The read and the fixes are priced fixed, so you know the cost before work starts. Fixed pricing also means the scope is written down, which protects both sides.

What should the report look like?

A ranked list of findings in plain English, what each risks, the fix for each, and a way to confirm it is closed. You should be able to hand it to any developer and have them start the same day.

Keep reading

Run the free Leak CheckFree. Seven checks, no signup.Leak CheckFree automated scan of a live app, seven checks, no signup.Ship CheckA human read of your codebase and an honest verdict.Ship FixBuilt fast, now breaking: made stable and shippable.PricingEvery service and price in one place.App development costWhat the market charges, what moves the price, and what we charge.Ten-item pre-launch checklistRun this before you ask anyone to fix the app.

Sources

1. Continuum pricing, Continuum: Used for every Continuum price on the page. The prices are read from the same list that renders /pricing.
2. The free launch checklist for AI-built apps, Continuum: Used for the key-handling and row level security points, each of which links to the vendor documentation on that page.