01
Code nobody fully read
Generated code works on the first try and hides the problem: a key in the browser, a database open to every user, an admin route with no check.
~/your-product$tendcrew build --secure
Build it. Secure it. Run it.
The senior engineering and security crew for companies moving at AI speed. We build your software, find what is exposed, leaking or malicious, fix it, and keep it running. One crew, on retainer or by project.
crew.log · example weeklive
1Request
2Build
3Secure
4Live
0releases shipped
0threats stopped
99.98%uptime this week
What we find and fix
Leaked secretsPrompt injectionMalicious packagesBroken access controlData exfiltration via AI agentsInsecure paymentsMisconfigured cloudSupply-chain attacksExposed admin panelsUnprotected APIs
The gap
Shipping got faster. Review didn't.
AI coding tools let one developer ship what used to take a team. The review, testing and security work between "it works" and "it's live" did not speed up with it. That gap is where breaches start.
02
Packages nobody chose
AI tools install dependencies by name. Typosquatted and hijacked packages are written for exactly that, and they run with full access to your secrets.
03
Agents with the keys
AI features read email, documents and customer data, then act on it. One crafted message can make them leak data or misuse their tools.
Engineering
A senior team that ships every week.
Your own engineering crew without the hiring. We plan, build and release on a steady weekly rhythm, with security review on every change.
ENG-01
Product engineering
Web apps, mobile apps, CRMs, client portals and internal tools, designed, built and shipped by a senior team.
You get: weekly releases, code you own
ENG-02
AI-built app to production
Built it with Lovable, Bolt, Cursor or Replit? We make it stable, secure and ready for real customers and real scale.
You get: tests, auth, payments, a clean release path
ENG-03
Operations and uptime
Checks every five minutes, automatic recovery for common failures, backups, updates and a person who gets the alert.
You get: uptime, backups, a weekly report
Security
Assurance for everything you ship.
Fixed-scope assessments with a clear report, or continuous coverage on retainer. Every finding comes with evidence, impact and a fix we can implement for you.
SEC-01
AI code security audit
A line-level review of code written with Copilot, Cursor, Lovable, Bolt or Replit: auth, data rules, payments, secrets and every route that touches customer data.
You get: rated findings, proof, fixes, retest
SEC-02
Penetration testing
Authorized attacks on your web app, API and mobile app, the way a real attacker would try. Logic abuse, privilege escalation, injection, account takeover.
You get: exploit evidence, summary, retest letter
SEC-03
LLM and AI agent security
Prompt injection, data exfiltration, tool abuse and jailbreaks against your chatbots, copilots and agents. We test what they can be tricked into doing.
You get: attack transcripts, guardrails, tests
SEC-04
Secrets and supply chain
We hunt leaked keys in code, history, logs and builds, flag malicious or hijacked packages, and set up monitoring so the next one is caught the day it lands.
You get: rotated keys, locked dependencies, alerts
SEC-05
Cloud hardening
AWS, GCP, Cloudflare, Supabase, Firebase and Vercel reviewed for public buckets, open ports, over-privileged keys and missing logs. Then we close them.
You get: hardened config, least-privilege access
SEC-06
Compliance and fractional CISO
Get ready for SOC 2, HIPAA or ISO 27001 and answer enterprise security questionnaires with confidence. A security lead without the full-time hire.
You get: policies, controls, evidence, audit prep
Why one crew
We don't hand you a PDF. We fix it.
Most security firms find problems and leave. Most dev shops never look. Tendcrew does both, so what we find gets fixed and stays fixed.
A typical security firm
- Report delivered, work ends
- Your team fixes it, when it can
- Retest billed again
- Nobody watches what ships next
Tendcrew
- Findings fixed by our engineers
- Every fix shipped through tested releases
- Retest included, every time
- Review and monitoring on what ships next
What a finding looks like
Evidence your board and your engineers can both read.
- Severity rated on CVSS, mapped to OWASP
- Proof of the exploit, not a scanner guess
- Plain-language business impact
- The exact fix, and who ships it
- Retest result and closing letter
CRITICALCVSS 9.1TC-2026-014 · sample
Service key with full database access shipped in the browser bundle
Evidence
// assets/index-4f2a.js
const db = createClient(URL, "eyJhbGciOi...service_role")Impact
Anyone who opens the site can read, change or delete every customer record.
Fix
Key rotated. Privileged calls moved behind a server function with per-user checks. Row-level rules on 12 tables.
OPENOWASP A01 · Broken Access Control
Process
Scoped, authorized, closed out.
Every engagement runs the same way, so your team, legal and procurement know what happens and when.
Scope
NDA first. Targets, windows and rules agreed in writing before anything is touched.
day 1Test
Engineers test by hand, backed by our tooling. AI widens coverage; people confirm every finding.
1 to 3 weeksReport
Criticals reported the day we confirm them. Full report with severity, evidence and fixes.
end of testingFix
Your team fixes, or ours does. Every change goes through tests and review first.
your callRetest
We verify every fix and issue a closing letter for customers, auditors and investors.
includedEngagements
Three ways to work with us.
Put a crew on retainer, start with one assessment, or bring us in as your technical leadership.
Retainer
Crew
A senior engineering team on retainer, with security built in.
- Fixed monthly engineering capacity
- Weekly releases and report
- Security review on every release
- Monitoring, backups, uptime
- One person who answers
Fixed scope
Assess
A one-time audit or penetration test with a clear end date.
- AI code audit or pentest
- Full report and executive summary
- Free retest of every fix
- Closing letter
Leadership
Partner
A fractional CTO and CISO for teams selling to enterprise.
- Everything in Crew
- Quarterly penetration test
- SOC 2, HIPAA, ISO 27001 readiness
- Architecture and incident ownership
Every engagement is scoped and priced on a short call.
Our promise
Fixed stays fixed.
Every fix is retested at no charge. If a critical finding we closed comes back within 90 days, we fix it again, free.
How we handle your systems
Built for security teams to approve.
NDA before scope
Nothing is shared or tested until the agreement is signed.
Written authorization
Targets, windows and limits agreed in writing. No surprises in production.
Least-privilege access
Scoped, time-boxed credentials, revoked the day the work ends.
Your code stays yours
Client code is never used to train AI models. Repos stay in your accounts.
Findings handled as secrets
Reports go through encrypted channels to named people only.
Questionnaire ready
We complete vendor security questionnaires as part of onboarding.
Questions
Straight answers.
Are you an AI company? +
No. We are an engineering and security firm. We use AI to cover more ground, faster, and every finding and every change is confirmed and owned by an engineer.
Do you only work on AI-built software? +
No. Most products today mix code written by people, by AI and by third-party packages. We build and secure all of it. AI-built code is simply where we find the most urgent issues.
Do you run the SOC 2 audit itself? +
The audit itself must be done by an independent CPA firm. We get you ready: controls, policies, evidence and the technical fixes, so the audit goes smoothly.
Will testing break production? +
Destructive tests run only on staging or inside windows you approve. Rules of engagement are agreed in writing before we start.
Do I own the code? +
Yes. The code lives in your repositories and your accounts. If you leave, you keep everything, including the documentation we write along the way.
Get started
Build fast. Ship safe.
Tell us what you are building or running. An engineer replies with a proposed scope, timeline and price.