For investors · figures as of 11 September 2026 · targets are labelled
AI now writes most of the code in new SaaS apps. Nobody can review it at that speed. Audit AI turns a security finding into a verified outcome: reproduced, fixed, tested, proven, merged.
The gap between generation speed and confidence is the market. Semgrep, Snyk and GitHub already do "find and suggest a fix" inside coding agents. That validates demand and raises the bar: a warning is no longer a product.
One question every multi-tenant app must answer: can user A read or change user B's data? Audit AI answers it with evidence, not a score, and closes the loop with a fix and a test.
AUDIT-001 Cross-tenant invoice read CRITICAL Entry GET /api/invoices/:id Expected Tenant A cannot read Tenant B Before Alice → Bob's invoice HTTP 200 ✗ Patch RLS-bound client + tenant scope After Alice → Bob's invoice HTTP 403 ✓ Existing tests 142/142 · security tests 5/5 · re-scan clean Verdict VERIFIED FIX
Next.js + Supabase in TypeScript is the stack that Lovable, Bolt, v0, Cursor and Claude Code generate for most SaaS apps, and the authorization family (IDOR, tenant isolation, RLS, service-role misuse) is where they leak. Deep on one stack and one class before wide.
Not the model: everyone has the same models. The compounding assets are the framework-specific security graph, the corpus of verified findings with before/after regression tests, the dataset of accepted and rejected fixes, and per-company security policies that make every next audit cheaper and more precise.
$0
Solo builders. Distribution and data.
$59/dev/mo
SaaS teams of 5–50. Merge gates and proofs.
$99/dev/mo
Policies, audit log, SSO, private runner.
Targets, not measurements yet: variable cost per active paid user ≈ $15 (model, sandbox, storage), gross margin ≈ 75%. Prices are anchored above Semgrep ($30) and Snyk ($25) and justified only by verified outcomes, which is why verification is the core, not a feature.
Parser for Next.js routes and server actions, Supabase clients and queries, RLS policies from migrations. Program Security Graph. 20 rules for the authorization family (tables, storage, SECURITY DEFINER functions, RLS policies read straight from the migrations, unverified sessions trusted by server code). Open source.
10 intentionally vulnerable apps with secure twins. Gate: every vulnerable app must be caught, every secure app must produce zero findings. Runs on every commit.
Bounded context slices, structured JSON from Claude, minimal search/replace patches validated against the files, regression tests generated to a DENY/ALLOW convention.
Ephemeral Supabase + app in a no-egress container. Two proofs produced end to end: HTTP 200 before, 403 after, re-scan clean. Runs weekly on GitHub Actions.
GitHub App live (checks with line annotations on PRs), MCP server for Claude Code and Cursor, CLI. Site with waitlist on auditai.sh.
Built from zero to a working verification loop in the first weeks, by one founder with AI coding agents. That is also the customer's workflow, so the product is dogfooded on itself: the scanner runs on this site and on every pull request in our repository.
| Weeks 1–10 | Engine, evals, reasoning, fixes, sandbox proofs, GitHub App, MCP | done |
|---|---|---|
| Weeks 11–12 | First teams on real repositories, blocking precision measured, first paid pilots via merchant of record | now |
| Q4 2026 | Fix Acceptance and Verified Fix Rate above targets; second vulnerability class; VS Code extension | next |
| 2027 | Security memory per company, private runners, enterprise policies; entity in the UAE; pre-seed | later |
Milestones we report against: real teams installed, 20+ real findings reviewed, blocking precision measured (done on five blind samples: 35%, 49%, 32%, 32%, then 18% on the 17 blocking findings of the fifth), Fix Acceptance and Verified Fix Rate measured, 3–5 teams paying.
We are talking to investors now: a pre-seed of $1–2M to fund two engineers (security and static analysis, developer tools), model and sandbox infrastructure, and founder-led developer marketing. Introductions to Next.js + Supabase teams and agencies help just as much. Operating entity planned in the UAE; holding structure per investor requirements.
Building in public as audit0. Product, distribution and this codebase are one person plus AI coding agents, which is exactly the customer we serve. Progress, numbers and failures are posted weekly.