Harbor Artificial Contact
Menu Close

Code & AppSec · S-CODE-3

Secrets Exposure Sweep

Find leaked keys in your code and git history.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Compare 3 tiers Book a call

Pricing

Compare tiers

Pay the deposit to start. Pay the final balance before handoff.

Starter

$450

Hours. 3 hours

Scope. 1 repo, full history

Deliverables

  • Secrets table (redacted), rotation checklist, pre-commit hook config

Turnaround. 2 business days

Pay deposit ($225) (opens Stripe in a new tab) Pay final balance ($225) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Standard

$900

Hours. 6.5 hours

Scope. ≤5 repos, full history

Deliverables

  • Starter items
  • CI secret-scanning config
  • history-rewrite guidance

Turnaround. 4 business days

Pay deposit ($450) (opens Stripe in a new tab) Pay final balance ($450) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Advanced

$1,700

Hours. 13 hours

Scope. ≤15 repos + CI config and build logs Harbor is given

Deliverables

  • Standard items
  • secrets-management design note

Turnaround. 6 business days

Pay deposit ($850) (opens Stripe in a new tab) Pay final balance ($850) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Retest included: Starter, one retest of Critical and High findings within 30 days; Standard, one retest of all findings within 45 days; Advanced, two retests within 60 days. Another round is the Extra Retest add-on.

Scope

Deliverables, limits, and standards

Standards mapping

CWE-798 / CWE-312; OWASP Top 10:2025 A04 Cryptographic Failures / A02 Misconfiguration as applicable; NIST CSF 2.0 PR.AA / PR.DS.

Exclusions

  • Rotating secrets (client does this)
  • testing whether found secrets are live unless written authorization names it
  • scanning systems outside provided repos

Acceptance

All secrets in the report are redacted to first 4 chars; each has a file/commit reference and a rotation owner field.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Book a call All security services

More in Code & AppSec

Not sure this tier is the one?

Email [email protected] with the system you want reviewed. We will point at a tier in this catalog, or tell you if the work is outside it.

Book a call All security services