Managed QA for teams that ship with AI
A flat monthly service that tests every release against a published checklist, grows your automated suite, and gives you one person to ask.
For a CTO, VP Engineering or founding engineer with a 3-25 person team, a codebase that is mostly written with Cursor, Copilot, Claude Code, Windsurf, Lovable or Bolt, and a release cadence that has outrun its testing.
Termscritical flow (a path a user takes that costs money or trust if it breaks: sign-up, checkout, invite, export) · verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it) · row-level security (database rules that decide which rows each signed-in user may read or write) · webhook (a message a provider such as Stripe sends to your server when something happens, like a payment) · CI (the pipeline that builds and tests every change before it can be merged or deployed) · LLM feature (a product feature that calls a large language model, such as an assistant or a summariser) · staging environment (a copy of production, without customer data, where release candidates are tested)
Published prices, limits shown
3-8 engineers, weekly releases, web
$2,900/mo
up to 2 releases per week
Included
Not included
Guarantees apply to every plan.
8-15 engineers, daily releases, web plus API or one mobile platform
$5,900/mo
daily releases
Included
Not included
Guarantees apply to every plan.
15-25 engineers, continuous delivery, multiple surfaces
$9,900/mo
continuous
Included
Not included
Guarantees apply to every plan.
Map of critical flows and their coverage, prioritised risk list from the failure catalogue, recommended plan. 5 business days. Credited to the first month.
Public methodology
Published in full, versioned, with a pass criterion and a severity on every item. A team can run it themselves. We run it on every release.
Release checklist, five of the published items
v1.0 · verified on 2026-09-21No secret keys in client bundles
automated Scan the built client assets (JS, source maps, HTML) for known key prefixes and for every value present in the server environment file.
Zero matches for key prefixes (sk_, service_role, AKIA, whsec_, private keys) and zero server-only env values found in client assets.
Policies deny cross-tenant reads and writes when tested as another user
automated For every table or collection, sign in as user A, create a row, then as user B attempt select, update and delete on it through the client API.
User B receives zero rows on select and a permission error on update and delete, for every table.
Server actions and API mutations re-check authentication and authorization
automated Invoke each server action or mutation endpoint directly by POST, without a session and with another user's session.
Every mutation rejects the unauthenticated call and the foreign-user call.
Webhook signatures are verified against the raw body
automated Send an unsigned event, an event with an altered body, and an event signed with the wrong secret to the webhook endpoint.
All three are rejected with a 4xx status and no state change.
Spend cap enforced per user and globally
automated In a test account, make model calls past the per-user cap and, in staging, past the global daily cap.
Calls beyond either cap are refused with a user-visible message and a log entry; no further provider spend is recorded.
Onboarding
Read access to the repository, a staging environment, your release cadence, and the named contact on your side. Nothing to install.
We map the critical user flows, run the checklist against the current build and send the first list of findings by severity.
The first release gets a written verdict. The automated suite is scaffolded in your CI, in your repository, under your ownership.
Automated coverage grows each week and reaches the plan's flow limit by the end of month 2. From week 2 every release runs the checklist and the suite, and the monthly report starts.
The failure catalogue
Five of 56 documented patterns, each with a source. The checklist starts from these, not from a generic template.
A table created by a migration or SQL has no row-level security, so the anonymous key can read and write every row through the public API.
A key meant for the server ends up in JavaScript the browser downloads, so anyone can read it and call the service as the app.
The page checks the session, but the exported action it calls does not, and actions can be invoked by direct POST.
The endpoint that marks orders paid or plans active trusts any request that looks like an event.
Nothing limits how many tokens one user, or the whole app, can consume, so a loop or a hostile user runs up the provider bill.
Written and shown on every plan
Guarantees, written and shown on every plan
Exit terms. Monthly. Cancel with 30 days' notice. No setup fee. The coverage audit fee is credited to the first month of any plan started within 60 days.
Synthetic sample
Monthly report
Month 3 (synthetic)
Releases tested
16
Pass · pass with findings
12 · 3
Fail
1
Every release
A written verdict: Pass Pass with findings Fail with findings by severity, the checklist id and pattern for each, the build and the checklist version.
Every month, by the 5th business day
Releases tested, verdicts, findings by severity, coverage growth in flows against the plan limit, flaky-test handling, next month's plan. See the synthetic sample.
Limits, written down
What we cannot do
We test against a defined scope and report what we find. We do not guarantee bug-free releases. We do not write your product code. We are not a certified penetration-testing firm and do not issue compliance attestations. Coverage limits per plan are explicit and apply.
Email only
Write to hello@managedqapartners.com with your team size, release cadence, stacks and the AI tools you use. We reply within 24 hours on business days.
Plan buttons open a prefilled email with that template. No forms, no calls to book, no analytics on this site.