Security check

A professional security check for a product built with AI-assisted development.

A real team reviews it, not only an AI tool.

Book a Call

When you need it

Vibe coding or AI-assisted build

You built a product, or part of a product, with vibe coding or other AI-assisted development.

B2B compliance and evidence

A B2B customer asks for compliance and evidence.

Professional security posture review

You want a professional review of the security posture.

What you get

Secure development principles

An introduction to secure development principles and how to apply them.

Secure code review with report

A secure code review of your product, with a written report of findings and what to fix first.

Guidance and supervision

Guidance through the process, and supervision afterwards if you need it.

What is secure development principles

Secure development principles mean considering security throughout the product's lifecycle - not only checking the code before release. (NIST SP 800-218)

Define security requirements: identify what needs protecting and what the product must do securely.
Design with security in mind: consider how the product could be misused and address those risks in its design.
Protect the development process: control access to source code, development tools, and releases.
Use secure coding practices: follow practices appropriate to the technology and review third-party components.
Review and test: check the code and the running product, assess findings, and address vulnerabilities.
Maintain security after release: monitor for vulnerabilities, provide fixes, and prevent similar problems from recurring.

Why it matters

B2B customers may ask for evidence that your product was built and reviewed with security in mind, even when no specific law applies to you. These requests may reflect their own compliance obligations or the standards they follow, such as those outlined below. We help you understand which requirements apply to your product, what your customers expect, and what evidence you need.

ISO 27001

ISO 27001 expects secure development rules to be established and used. A policy alone does not demonstrate that they are followed.

DORA

DORA requires in-scope financial firms to manage ICT risk throughout the system lifecycle, including development and testing. Your financial-sector customer may ask you for supporting evidence.

Cyber Resilience Act

The Cyber Resilience Act sets secure development, technical documentation, and vulnerability-handling requirements for in-scope products with digital elements.

How it works

FAQs

What counts as a vibe-coded app?

Any product built with AI coding tools or vibe coding, including apps put together from generated or pasted code, often without a dedicated security review before launch or sale.

Do you need full source-code access?

Yes. A useful review needs access to the relevant source code and configuration. We agree the scope and access method up front.

Will you fix the issues for us?

The core offering is secure code review with report and secure development guidance. We can help with development services - ask us for a quote.

How long does it take?

Timing depends on product size and complexity. Many focused checks complete within a few working days after we have access and context. Meeting compliance requirements, or reviewing corporate and enterprise products, will require a longer turnaround.

How Boxfish Labs can help

Virtual CISO (vCISO)

Subscription-based strategic and senior security expert support, without a full-time hire

Explore: Virtual CISO (vCISO)

External DPO

Assigned Data Protection Officer when required by GDPR, with practical privacy support for your team

Explore: External DPO

Security Advisory for Founders

Security advice and decision-making support for founders, managing directors and leadership

Explore: Security Advisory for Founders

Cyber Trainings and Simulations

Strengthening the human layer - the majority of incidents involve people, not only technology

Explore: Cyber Trainings and Simulations

Data Residency & Sovereignty

Choose EU providers and control data flows

Explore: Data Residency & Sovereignty

Get a professional security check for your AI-assisted product

Book a short call. We want to know what you are building and help your product become secure and compliant, no obligations at this step.