SKU · audit + retainer
Legacy Security Patches
Security patches for one legacy Rails, PHP, Elixir, or Go app. We do not rewrite it.
One week to inventory a named legacy codebase, then a monthly watch that applies security patches and proves the version that is actually running. €3,000 for the audit, then €2,000/mo with a three-month minimum. Ruby on Rails, PHP, Elixir, or Go — one stack per SOW.
The wound
What this is for
The app still takes production traffic, and the runtime or a dependency just got a security release. Nobody owns the lockfile. PHP is whatever the image baked two years ago. Rails is a version the advisory names. Elixir is an OTP the team cannot name. A rewrite is a different project. A patch, a smoke check, and a written version is this one.
- A team with one production Rails, PHP, Elixir, or Go app that is past the version they meant to be on
- A founder who can give repo and runtime access in week 1 and will not ask for new features in the same SOW
- Someone who wants a named person to read the advisory and apply the fix, not a scanner PDF
Patch audit (1 week)
€3,000
100% to start. One named codebase. Written note of versions, EOL, and advisories that already apply.
Patch retainer
€2,000/mo
Monthly in advance, three-month minimum. One stack (Rails, PHP, Elixir, or Go). Security bumps only.
Cap: two concurrent retainers studio-wide. Written SOW. No handshake starts.
Audit, then a monthly watch
What the weeks look like
Week 1
Inventory the running version
Read the lockfile and the runtime that production actually starts: Ruby and Rails, PHP and Composer, Elixir and OTP, or Go modules. List end-of-life dates and the advisories that already apply. If we cannot see the deployed version in five days, we stop. You pay for the week you received.
Each month
Watch, patch, prove
Read the security releases for that stack. Open a branch or a PR on your repo with the security bump only. Run the test suite you already have. Record the version that deployed. No feature work on the side.
When the runtime is unsupported
Say so in writing
If the vendor no longer ships a fix — PHP 8.1 and older is the current example — we say that in the note. A config workaround is not a patch. Moving the app to a supported runtime is Full Stack Development or a separate SOW.
Handover
You keep the repo
You own the Git host and the servers. We are a user. The retainer is the watch. Cancel after month 3.
In
Included
- One named codebase: Ruby on Rails, PHP, Elixir, or Go
- Runtime plus lockfile (Bundler, Composer, Mix, or Go modules)
- Monthly security bump on a branch or PR you merge
- Smoke check against the suite you already have, plus the deployed version in writing
- Slack, one business-day response on that codebase
1 business day on the patch channel
Out
Not included
- New features, a redesign, or a framework upgrade that is not required by the security fix
- A second app or a second language in the same retainer
- Rewriting the hot path (that is Full Stack Development)
- Provision and deploy pipelines (that is Legacy Pipeline Patches)
- 24/7 on-call, exploit development, or owning your Git host
Questions
Before you book
A security bump inside the version you run is this SKU. A major upgrade that changes application code is custom work or Full Stack Development. We say which one it is in week 1.
Only when we can patch the runtime and the code you own. A proprietary appliance with no repo is the wrong buy.
You get that in writing, with the vendor’s own wording. We do not invent a workaround and call it patched.
Named SKUs. Pick one. Do not invent a new one on the call.
Patch audit (1 week) €3,000 · Patch retainer €2,000/mo. Written SOW. 100% up front unless the offer says otherwise.