NOVITAS VERIFYFreelance Services
Independent verification & reporting [email protected]

Novitas Verify · Freelance services

Get your app checked.
Get the proof.

Verify is a checking service run by its owner and powered by Novitas software. You send the work; the software runs; every finding is read and dispositioned one by one — and what you get back is a plain-English report with the evidence attached, not a pile of alarms.

Prefer plain email? Write to [email protected] — every intake is answered by a person.

Services & fees

The menu — all five, ready now

Fixed starting prices, quoted in writing before any paid work begins. Every service is delivered with its evidence.

Evidence

The proof, not the pitch

Before selling a single scan, we ran the instrument over other people’s public code and published what it found — including the parts that make a cheap scanner look bad.

The sample run

We ran our calibrated scanner over two public codebases: 230 files, 28,900 lines, 16 findings. 1 was a real defect (now the fix-first item), 1 a watch item, and 14 were cleared — each with its reason printed. Nothing buried.

The one real defect: in the Spark web framework, the cookie-deletion path builds the cookie without the Secure flag that its own sibling method sets — a genuine, one-line defect in a framework other people build on. A cheap scan hands you 16 alarms and a panic. This service hands you 1 thing to fix, 1 thing to watch, and proof the other 14 were actually looked at.

The watch item — random-number ID generation inside a bundled example app — was reported as exactly that: harmless in a demo, dangerous if copied into production.

The instrument, measured

0.4100
Youden’s J score on the OWASP Benchmark
0.7169
Precision on the OWASP Benchmark — when it flags, how often it is right
78.7%
Of real bugs detected on a sealed JavaScript bug corpus
0.8%
False-positive rate on that same sealed corpus

On the OWASP Benchmark, the same instrument scores J 0.4100 with precision 0.7169, and on a sealed JavaScript bug corpus it detected 78.7% of real bugs at a 0.8% false-positive rate. Those numbers are also why the human read is part of the service: the instrument is good, it is not perfect, and the report says so on its face.

Honest limits, stated up front

  • A scan is not a penetration test and not a certification. It does not make an app “secure” or “bug-free,” and no report from this service will ever claim that.
  • Every report states its own scope and limits — what was checked, what was not, and what the instrument can and cannot see.
  • Fees buy the work, never the verdict. PASS, FAIL, and UNKNOWN are all possible outcomes of a paid check.

Process

How it works

Three steps. No account, no portal, no obligation until a price is in writing and you have said yes to it.

Send the intake form

Fill in the form below. It goes straight to [email protected] — no account, no portal.

Get a written quote

You receive a written quote for your exact job. The final price is confirmed in writing before any paid work begins — no surprises after the fact.

The software runs

The check runs, the findings are read one by one, and you receive the report and its evidence by email.

Payment: a payment link is sent with your confirmed quote. You pay only after you have seen the final price in writing and accepted it.

Intake

Customer intake

Answer what you can — the quote comes back in writing either way. Fields marked * are needed to reply and quote accurately.

Service selected Security Scan Report from $500 · per scan
Please add your name so we know who we’re replying to.
Please add a valid email address — the quote and report go there.
A launch date, a due date, or “no rush” in the notes is fine too.
Please pick the service closest to what you need.
A sentence or two is enough — what is it, and what worries you about it?
A link is ideal. If the code is private, just say how you’d share it — we’ll arrange access in the reply. Do not send access credentials here.
Saying so costs nothing — it points the check at the right place first.

Never send passwords. Not in this form, not by email, not ever. If access is needed, it is arranged separately and safely after the quote.

Three acknowledgements

These are the standing terms of every Verify check. All three are required to send an intake.

This sends your intake straight to [email protected]. Every intake is answered by a person — the written quote comes back to your email.