Security engagement
Security retainer
Most risk arrives after the audit, in the commits that ship on a Tuesday. A retainer keeps a reviewer inside that loop: a fixed number of review days each month for new code and deploy diffs, a direct line for design questions before they become code, and triage of anything your team or your bug-bounty program turns up.
from $4,500 / month · quoted in writing after scope
Who it is for
For a live protocol or product that ships every week and wants a named reviewer who already knows the codebase, rather than a fresh audit bought after the fact.
What is in scope
- Review of new modules and changes to existing ones, against the invariants agreed at the start
- Deploy diffs and configuration changes, including upgrade and migration scripts
- Design review before implementation: access control, accounting, external integrations
- Triage and reproduction of reports from your team, customers or a bug-bounty program
- Advisory on incidents, with a written timeline and root cause where one is needed
What you get
- A fixed number of review days each month, scheduled in advance
- Written review notes per change, with severity and a clear go or no-go
- A direct channel to me for the duration of the retainer
- A monthly summary of what was reviewed, what was found and what remains open
Frequently asked
How many review days are included?
Three days a month is the default, which covers a steady shipping cadence for a small protocol. Unused days do not roll over; if a month needs more, they are billed at the daily rate agreed in the retainer.
Is the retainer a replacement for an audit?
No. A retainer reviews change, it does not replace a full pre-launch audit of a new codebase. Most teams start with an audit, then move to a retainer once the code is live.
What is the minimum term?
Three months. A retainer only works once the reviewer knows the codebase, and that takes the first month.
Scope it in one message
Send the targets, the commit and the timeline. You get the rules of engagement and a fixed price.
References available on request. No client names or numbers are published without written consent. Part of an ongoing relationship instead? See the full service list.