Prsho — evidence-based security review of code
PROTECTED
GET /api/orders/<id>/ — login + owner checkexample_app/views.py:44ISSUE
DELETE /api/orders/<id>/ — no permission checkexample_app/views.py:71NOT ESTABLISHED
/api/export/ — view connected dynamically (getattr)example_app/urls.py:18Every finding comes with a file and a line — without running your code. Where proof is not possible, we say “not established” instead of guessing.
What we work on
- An evidence-backed map of your application — its URLs, the code behind them, and what protects each one.
- Access control and customer data isolation — whether one customer of a SaaS service can reach another customer’s data.
- Finding security vulnerabilities in code built by AI agents (planned) — starting with Python.
- Security audits (planned) — tools plus a specialist, with a report backed by evidence.
Our current focus is Python and Django, including Django REST Framework. JavaScript/TypeScript is planned; other languages later.
How we work
- Evidence for every finding: a file and a line you can open and check.
- Honest uncertainty: “not established”, with the reason — never a guess.
- Local analysis: your code is not executed and is not sent anywhere.
- Repeatable: the same code gives the same result.
Products
Several products are in development. Nothing is for sale yet.
Research
We publish what our tools do and how well — once it is measured. Research
Questions or interest in early access: info@prsho.com