Updates

COMING SOON

Weeks of code review in a few machine hours

~/qawai $ coming soon · ganbatte!

QAWAI audits software built with AI, reading every file and document through six specialist passes plus docs against code. Only findings that survive fresh checkers reach you: on a live 213,311-line product, 471 engineer-hours of review for $463.

It reads your code, runs your web app only in a fenced copy when you say yes, and every report says what it could not check.

Two real products
One read by a human, one read by QAWAI

CASE 01 · WEB APP

A full-stack SaaS web app with an API, job queues and billing, live in production

  • React + Vite
  • Node API on Fastify
  • PostgreSQL, 165 migrations
  • Redis job queues
  • Stripe billing
  • Clerk sign-in
  • S3 file storage
  • 5 ad-network APIs
  • LLM providers
  • Sentry

HUMAN

471h
11.8 working weeks
$43,339
of engineer time

QAWAI

5.1h
machine hours
$463
$414 of tokens, plus $49

SAVED ON THIS ONE AUDIT

$42,876466h

money and engineer-hours, against one engineer reading the code once

  • 213,311lines of code
  • 264documents
  • 284,422lines of tests guarding it
  • 901/903product files read
  • 141verified findings, each with its evidence
  • 265false alarms removed
  • 94×less money

CASE 02 · CROSS-PLATFORM APP

A cross-platform app for iOS, Android and the web, with its own website

  • React Native + Expo
  • iOS
  • Android
  • Web
  • In-app subscriptions
  • Encrypted on-device database
  • Notifications
  • Audio
  • AI suggestions
  • Static site build

HUMAN

3,964min
66 hours, 1.7 working weeks
$6,082
of engineer time

QAWAI

88min
machine time
$133
$84 of tokens, plus $49

SAVED ON THIS ONE AUDIT

$5,9493,876min

money and engineer-minutes, against one engineer reading the code once

  • 26,532lines of code
  • 23documents
  • 189/189product files read
  • 31verified findings, each with its evidence
  • 78false alarms removed
  • 46×less money

Only real problems reach you, never false alarms

Reading code turns up suspicions, and most are wrong.

Fresh checkers try to disprove each suspicion against the code before it reaches you. Serious findings need two votes from three checkers to stay; a script counts the votes, not a model.

Your team reads 120 confirmed findings, not 385 maybes: 44 hours of chasing false alarms that never land on anyone's desk.

385suspected problems, found by reading your code
  • REACHABILITYCan a real user or request get there?
  • IMPACTDoes it matter, and how much?
  • DEFENSESIs something already stopping it?
120confirmed real
265ruled out as false alarms (69%)

A RESET EMAIL THAT WAS NEVER SENT

An admin's "Reset password" button signed the user out and logged a reset as delivered. No reset was ever sent.

Case 01, the web platform. A truth bug: nothing to exploit, and no scanner rule to catch it.

A WEBSITE BUILD THAT COULD NEVER PASS

The website's build could never succeed: its page held placeholders the build script never filled.

Case 02, the app's website. Found by reading the page and its build script side by side.

AN AI BILL ANY USER COULD RUN UP

When an AI run failed, the app handed back the daily usage limit for AI calls it had already paid for. One user could repeat failing runs and run up the AI bill.

Case 01, the web platform. Found by following the money through the failure path.

NOTICES FOR CANCELLED MAINTENANCE

Cancelling a scheduled maintenance did not stop the notification emails already going out. Users kept getting notices for maintenance that was no longer happening.

Case 01, the web platform. On a large user base, that is thousands of misleading emails from the product's own domain.

Keep your security scanner
Then read the rest

Eight days before this audit, Claude Security scanned case 01's API and verified 8 issues; 7 were fixed that day.

QAWAI then read the whole product: 141 findings, 138 outside security, and 3 security findings in code the earlier scan had already read.

  • Docs against code55
  • Interface29
  • Design, no AI20
  • Architecture18
  • Failure and edge cases9
  • Misuse6
  • Security3
  • Other check, no AI1
1 in 18

claims in case 01's docs no longer matched the code: 145 of the 2,635 QAWAI checked. In case 02 it was 1 in 10.

Six specialist passes: security, privacy, architecture, interface, failure and edge cases, misuse. Plus every document checked against the code.

Five steps
Your folder never changes

  1. COPY

    A disposable copy. Known secret files are skipped unopened; agent instruction files stay out.

  2. READ

    Every product file and document, in slices sized to the model, each one accounted for.

  3. CHECK

    Six specialist passes and docs against code, three at a time.

  4. VOTE

    A fresh checker per draft, three for serious ones. Two votes of three to stay.

  5. REPORT

    One page: a grade, the evidence, a fix prompt to paste into your AI.

Case 01's folder, checked before and after: 50,499 entries, unchanged.

With your yes, it runs your web app in its fenced copy, on this computer only, internet blocked. Case 01's web app was started there and looked at on phone, tablet and desktop widths, light and dark.

Your code goes to your AI provider
Never to QAWAI

  • Read from a disposable copy. Your folder is checked before and after.
  • Known secret files are skipped without being opened. Your agent's instruction files are left out, so the project can't tell its auditor what to conclude.
  • Your app runs only after you say yes: in a fence, on this computer only, with the internet blocked.
  • An anonymous scorecard of numbers is sent unless you run qawai telemetry off. Block it and the audit comes out byte-identical.
  • npm's public registry is asked about the packages your lockfile got from it, names and versions only, unless you run qawai packages off. Off or offline, your grade stays the same.

What it can't tell you

  • It is not a penetration test, and there is no red-team pass.
  • No audit finds everything. Read the report as an expert's first week, not the last word.
  • It runs apps on macOS: web apps, Expo web targets and Node command-line tools. iPhone apps are not run.
  • Measured with Claude Code. Other AI agents are not verified yet, so this page does not claim them.
  • Every number here comes from two runs on two products, not a benchmark.

Run your own numbers

One engineer reads it once at 500 lines an hour. QAWAI's range comes from its two measured runs.

ONE ENGINEER, READING ONCE

427 hours · 10.7 working weeks$39,275

QAWAI FULL AUDIT, TOKENS + $49

37.6M to 64.8M tokens · 5.1 to 11.8 machine hours$463 to $722

YOU SAVE

$38,553 to $38,812415 to 422 engineer-hours · about 54× to 85× less

Every file read
Every finding has to prove itself

Yosh — keep building. Get QAWAI launch news and product updates by email.