Hacker News Reader

Happened to me as well. Was writing an authentication service. We thought we were paying for an actual security audit, turns out we payed for a simple word scanning of our codebase. The review didn't find any of the canaries we left in the codebase, and we could never argue back with them. Big waste of money.

View on HN

Huh. I'm thinking it'd be fun to write code with know issues (with varying degrees of obviousness) and hire a bunch of different "auditing companies" to see which ones pick up on that.

Publish the result for market comparison's sake.

Then again, that requires plenty of money and I can't see how to monetize that in any way.

Reply on news.ycombinator.com