What's included

Immediate containment: leaked keys and secrets rotated across every service that used them
Open storage, public databases, and exploitable endpoints closed or disabled
A check for signs of abuse while the door was open, so you know what actually happened
A written incident summary in plain language: what was exposed, what was done, and what to watch
A 30-minute handoff call with the biggest remaining risks named

Who this is for

You just found out something is exposed, or someone else found it for you. Your app is live, people are using it, and you need the door closed now. The explanation can wait.

You just found your database or a storage bucket was public.
An API key is sitting in your repo history, your client code, or a paste you can’t retract.
Traffic or AI-API spend spiked overnight in a way that looks like abuse.
A security researcher, or just a stranger, emailed you about a hole.

This is the engagement for the bad day. It is built to be fast, and it starts the day you say go.

What happens

First hours: stop the bleeding. Every leaked secret gets rotated, public storage gets closed, and endpoints that should never have been reachable get disabled. Authentication and API exposure get checked first, because those are the doors AI-built apps most often leave unlocked.

Day one to two: check the blast radius. Closing the door tells you nothing about who already walked through it, so the next pass looks for signs of actual abuse: unfamiliar access, strange data movement, spend that doesn’t match usage. You end up knowing what happened instead of guessing at what might have.

Day two to three: hand it back in writing. You get a plain-language incident summary: what was exposed, for roughly how long, what was done about it, and what to watch going forward. It’s written so you can forward it to a customer, a partner, or an investor without translating it first.

What you walk away with

A contained incident instead of a growing one. Secrets rotated, doors closed, a written summary you can stand behind, and the remaining risks named in priority order, each one specific enough to act on.

Triage closes the door; it doesn’t rebuild the frame. If deeper failure patterns caused the incident, the Stabilization Sprint is the follow-through. That’s a decision for after the fire is out, and it stays yours.

This is independent engineering guidance. It is not a certified forensic investigation and not legal advice. If you may have breach-notification obligations, loop in counsel early.

Not sure this is the one you need?

Start with the free audit: a 30-minute look at your app and a Top 3 Risks brief. If this engagement is the right fix, you'll know exactly why before you spend a dollar.

Get a Free Tech Audit

Or email cto@dustinkendall.com