Engagement 1
Readiness Review
A senior check of whether your codebase is ready for a full review, and what that review should scope to. You get a defensible scope before you commit budget, and your audit hours go to finding bugs rather than to gaps a reviewer shouldn't be discovering on day one. For teams preparing for an audit.
Scope and pricing
- Scope
- Test suite, invariants, architecture, scope readiness, documentation, and a threat model.
- Deliverable
- Written readiness report with prioritized, actionable recommendations.
- Benefits
- Credited in full toward a founder-led audit booked within 60 days of report delivery.
- Timeline
- 1 - 5 working days.
- Price
- From $1,500, depending on scope.
- Not included
- In-depth economic analysis, comprehensive vulnerability assessment, fuzzing, or formal verification.
This tells you what to fix before a deeper review, at a fraction of the cost.
Engagement 2
Founder-Led Audit
A deep manual review led by Joe Stakey. I combine automated tooling with the adversarial reasoning and whitehat instinct that uncovered bugs in protocols already audited by top-tier firms. Every confirmed finding ships with a working proof of concept, so the fix is easy to verify.
Scoped to your full protocol, or focused on a single high-risk module.
Scope and pricing
- Scope
- Full protocol, or one critical module. Includes threat modeling and architecture review for pre-launch engagements.
- Deliverable
- Severity-rated findings report, each finding with a working PoC and clear remediation guidance. Fix verification on remediated findings included.
- Timeline
-
Confirmed at scoping. Typical timelines:
- Full protocol: 2-8 weeks.
- Single module: 1-2 weeks.
- Price
- Scoped per engagement, based on codebase size, complexity, and timeline. For larger or higher-risk scopes, a second senior reviewer provides independent, four-eyes coverage.
Best for pre-launch protocols, major module rewrites, and teams who want the review done by the person whose name is on it.
Engagement 3
Continuous Retainer
Protocols that ship continuously cannot realistically audit every release. The conventional alternative, annual audits from rotating teams, leaves months of unaudited code in production and forces reviewers to re-learn your protocol every time.
A retainer gives you ongoing senior review against a codebase. The reviewer who reads your code today is the same reviewer six months from now.
Scope and pricing
- Scope
- Diff and PR review against the audited codebase, architecture consultation on new features, security advisory. Includes a first-month onboarding deep-dive: protocol architecture, threat model, prior audit findings review, and identification of the highest-risk surfaces.
- Deliverable
-
Continuous PR review with SLA:
- Priority: review begins within 4 business hours
- Standard: review begins within 1 business day
- Benefits
- Priority scheduling on other engagements. 20% discount on a full audit.
- Timeline
- Continuous. Month-to-month, 30 days' notice, minimum initial term 3 months. Unused capacity rolls up to 4 months.
- Price
- From $1,500 per month, scoped to capacity.
- Not included
- Full security audits of major new modules and incident response beyond initial triage. Each scoped separately.
Best for live protocols shipping every few weeks, post-launch teams between major audits, and protocols wanting continuous senior security coverage alongside periodic large-firm audits.