FAQ
Questions, answered
What an assessment is, what it isn't, and what we need from you.
Is this a penetration test?
No. A Bronkode assessment is an advisory review of security best practices and code-level vulnerabilities, alongside architecture, reliability, engineering maturity, operations and cost. We don't perform active exploitation or attack simulation. If your situation calls for a penetration test, we'll say so.
Does the review cover changes made after the assessment?
No. Every assessment is a snapshot of your codebase on the review date. If you change the code afterwards, those changes aren't covered. Re-assessments of a codebase we've already reviewed are available at a reduced rate.
What do I need to provide?
- Read-only access to your code repository
- Details of your environments and how you deploy (hosting provider, database, third-party services)
- Any existing documentation, diagrams or notes, even if they're rough
We never need production passwords or customer data.
How long does it take?
It depends on the tier and the size of the codebase. Typical turnaround from receiving access:
- Launch Check: 3 business days
- Production Readiness Review: 5 business days
- Security & Architecture Assessment: 7–10 business days
- Technical Due Diligence: 10 business days
- Production Hardening Roadmap: 15 business days
We confirm the timeline before you book.
Is it a guarantee of security?
No. An assessment reduces risk by finding and prioritising problems. It can't eliminate risk or guarantee that a system is secure.
Do you fix the issues?
No. We give you a prioritised list of findings and, at higher tiers, a remediation roadmap your team or developer can work from. If you want ongoing guidance while you fix things, our monthly retainers cover architecture advice, reviews and sign-off.
Which tools and languages do you cover?
Any AI-generated stack, whether it was built with Cursor, Claude Code, GitHub Copilot, Lovable, Bolt, Replit or something else. If it's an unusual stack, mention it when you book and we'll confirm fit.
Is my code kept confidential?
Yes. We treat everything you share as confidential, use read-only access, and are happy to sign an NDA before you share anything. See confidentiality.
Which tier should I choose?
Most founders start with the Launch Check. Businesses deploying a system to staff or customers usually need the Production Readiness Review or the Security & Architecture Assessment. Investors should look at Technical Due Diligence. If you're unsure, book a call and we'll recommend one.
Is the checklist really free?
Yes. Download the AI Application Production Readiness Checklist. We'll occasionally send useful insights by email, and you can unsubscribe at any time.
Still have a question?
Book a call and ask us directly.