Questions to ask a firm testing your AI app
Every firm says it tests thoroughly. These questions separate the ones who log in and try to break your app from the ones who run a scanner and reformat the output.
Ask how many tester days the quote covers, whether testing is authenticated with every role, how they test access between users, whether AI features are in scope, whether a retest is included, and to see a redacted sample report. The answers show whether you are buying a person trying to break your app or a scanner run on its front page.
| Question | A good answer | Red flag |
|---|---|---|
| How many tester days is this? | A number, tied to the scope | "It is a fixed package" |
| Do you test logged in, as each role? | Yes, with accounts for every role | Unauthenticated only |
| How do you test one user reaching another's data? | Two or more accounts, manual ID and tenant testing | "Our tool checks for that" |
| Will you check our Supabase or Firebase rules? | Yes, directly against the API | Unsure what they are |
| Are our AI features in scope? | Yes, mapped to the OWASP LLM Top 10 | AI treated as out of scope by default |
| Do you read the code? | If you share it, and here is how it changes the price | No option |
| Is QA included or separate? | A clear answer and price | "Security covers it" |
| Is a retest included? | Yes, within a stated window | Silence, or extra by default |
| Can I see a redacted sample report? | Yes, today | Only a brochure |
| Who does the testing? | Named people with hands-on experience | Unnamed, offshore, unknown |
| What happens if you find something critical? | You hear the same day | It waits for the report |
| Where is our data and who can see it? | Clear handling and deletion terms | No answer |
Checking the price
Multiply the days by $1,500 to $2,800 CAD. A quote far below that for a multi-role app is a scan. A quote far above it should come with more days or a broader scope. The cost estimator gives you a fair range before you ask.
Asking us
These apply to TrazTech too. It sells vibe-coding QA and security review and operates this site; the directory lists others. General advice on vetting any security firm is on how to vet a firm.
Get quotes on one written scope
Quotes are only comparable if they answer the same scope.
Get matchedCommon questions
Should the cheapest quote win?
Only if it covers the same days and scope as the others. Otherwise it is a different product.
Do certifications matter?
They show hands-on training. A sample report shows more about what you will actually get.