# Yellow Theme > Fixed-fee engineering installs for Series A–C B2B SaaS: CI security gates, policy-as-code in your repos, and evidence organized for an independent assessor to examine. Not a GRC platform swap, and not a policy-PDF sprint. Exact fee is in the SOW. Public ranges only: Guardrails and Infrastructure as Code are typically mid five figures; the retainer is typically mid four figures per month. No hourly billing. We integrate with Terraform, OpenTofu, AWS, GCP, GitHub Actions, GitLab CI, OPA/Conftest, Semgrep, Trivy, Kubernetes, Vanta, and Drata. We do not replace Vanta or Drata. Async by default. Calls stay in the 7:00–10:30 AM CT window; written replies within 24 business hours can land later. Fixed-fee projects are not 24/7 on-call. A retainer P1 acknowledgment is not offered until monitoring and handoff exist. ## Site - [Home](https://www.yellow-theme.com/): What gets installed, sample artifacts, a free readiness check, who it is for, and the project brief. - [How we work](https://www.yellow-theme.com/how-we-work/): Brief → fit note → optional call by email reply → fixed SOW → deposit. Calls 7:00–10:30 AM CT; written replies within 24 business hours. No public calendar. - [Yellow Theme Method](https://www.yellow-theme.com/proof/methodology/): The yellow team builds security in. Yellow Theme plays yellow team for the client. Five delivery principles plus a map to notes, labs, policy-as-code repos, the readiness check, and the brief. - [Questionnaire unblock](https://www.yellow-theme.com/questionnaire-unblock/): Security questionnaire / enterprise review deadline → engineering gap in git → Guardrails. Not a GRC replacement. Mid five figures; exact fee in the SOW. - [SOC 2 engineering install](https://www.yellow-theme.com/soc-2/): Trust Services → CI gates → evidence index. Not the auditor. Mid five figures; exact fee in the SOW. - [Yellow Theme vs GRC platforms](https://www.yellow-theme.com/vs/grc-platforms/): Platforms organize the program; we install gates in git. Use both. We replace neither the platform nor the CPA. - [Project brief](https://www.yellow-theme.com/#async-questionnaire): Create a brief. Written fit note and fixed-fee SOW before any deposit. A short call after the fit note is welcomed when useful. Exact fee is in the SOW. A read-only assessment (control matrix, CI-versus-policy path, written findings) is the same brief, not a second product. The fee credits toward Guardrails if you continue. Free readiness stays free. - [Engineering readiness check](https://www.yellow-theme.com/tools/readiness/): Free 3-minute direction, not a score, on whether the engineering stack is in audit scramble or organized for an independent assessor. - [Sample deliverables](https://www.yellow-theme.com/proof/deliverables/): Synthetic evidence index, CI gates, policy-as-code, and retainer reports. Inspect the [CI workflow](https://github.com/yellow-theme/ci-security-gates/blob/main/.github/workflows/security-gates.yml), the [storage policy](https://github.com/yellow-theme/policy-as-code/blob/main/policies/storage/encryption.rego), and the [evidence index](https://github.com/yellow-theme/evidence-index/blob/main/examples/index.json). Samples are synthetic. - [What done looks like](https://www.yellow-theme.com/proof/success-criteria/): Shared definition of done for Guardrails, including non-goals. - [Insights](https://www.yellow-theme.com/proof/insights/): Curated SOC 2, CI/CD, and cloud security reading. ## Engineering notes Anonymized notes from building a multi-tenant evidence vault. No customer names, account ids, or ticket numbers. - [Engineering notes](https://www.yellow-theme.com/proof/notes/): Index of the notes below. - [WAF and Lambda Function URLs](https://www.yellow-theme.com/proof/notes/waf-lambda-function-urls/): Function URLs do not take a regional WAF. Put CloudFront in front. - [Branded API hostnames](https://www.yellow-theme.com/proof/notes/branded-api-hostnames/): Point browsers at a branded host, not the raw execute-api hostname. - [CORS download filenames](https://www.yellow-theme.com/proof/notes/cors-download-filenames/): Expose Content-Disposition or Save-As drops the file extension. - [Tenant isolation without a bucket per customer](https://www.yellow-theme.com/proof/notes/tenant-isolation-without-a-bucket-per-customer/): Prefix-bound keys and identical 404s on a shared bucket. - [Query parameters after the hash](https://www.yellow-theme.com/proof/notes/query-before-hash/): A URL like /#form?token= never puts the token in location.search. - [Function URL invoke permission](https://www.yellow-theme.com/proof/notes/function-url-invoke-permission/): A public Function URL needs InvokeFunctionUrl and InvokeFunction. - [The browser does not get the object key](https://www.yellow-theme.com/proof/notes/browser-does-not-get-the-object-key/): The client JSON keeps a basename. Download is a separate authenticated call. - [A retry has to return the first answer](https://www.yellow-theme.com/proof/notes/retry-returns-the-first-answer/): One submission token. A retry of that token returns the stored answer. - [The test path is not a directory](https://www.yellow-theme.com/proof/notes/test-path-is-not-a-directory/): The published reproduce step never evaluated a policy. opa test . walks the tree. - [The action tag fails before it scans](https://www.yellow-theme.com/proof/notes/action-tag-fails-before-it-scans/): Copying the homepage secret-scan action into an organization repository failed before a file was opened. The required check is the CLI. - [The example key does not fail the scan](https://www.yellow-theme.com/proof/notes/example-key-does-not-fail-the-scan/): A planted AWS example key was supposed to fail the secret scan. Default rules exited 0. A local rule is what fails. - [The form does not name the package](https://www.yellow-theme.com/proof/notes/form-does-not-name-the-package/): A known id maps to the server label. A title the browser also sent is ignored. - [Function URL still public behind CloudFront WAF](https://www.yellow-theme.com/proof/notes/function-url-still-public/): WAF on CloudFront does not protect a public Function URL bypass; require an origin secret. - [HttpOnly session refresh leak](https://www.yellow-theme.com/proof/notes/session-bff-refresh-leak/): An HttpOnly cookie does not help if /auth/session returns the refresh token to JavaScript. - [SafeMarkdown protocol-relative URLs](https://www.yellow-theme.com/proof/notes/markdown-protocol-relative/): startsWith("/") is not a same-origin check; reject //host. - [Playwright OAuth e2e sagas](https://www.yellow-theme.com/proof/notes/playwright-oauth-e2e-sagas/): Google login smoke stays Given/When/Then in pytest; make install-e2e / make test-e2e-auth. - [Late font faces must be optional](https://www.yellow-theme.com/proof/notes/late-font-faces-must-be-optional/): Only first-paint Latin faces use font-display block; late italic and weights stay optional. - [Managed Login only got Privacy and Terms](https://www.yellow-theme.com/proof/notes/managed-login-cannot-host-the-counsel-footer/): Hosted sign-in can attach document links; the counsel strip stays on app login stubs. - [Analytics that wait for a click](https://www.yellow-theme.com/proof/notes/rum-after-idle-not-in-head/): CloudWatch RUM loads after first input or eight seconds, then idle — not a blocking head script. - [SSH closed until break-glass](https://www.yellow-theme.com/proof/notes/signing-host-ssh-closed-by-default/): Signing-host SSH CIDRs default empty so port 22 stays closed. - [Reading Mode dropped the FAQ answers](https://www.yellow-theme.com/proof/notes/reading-mode-dropped-the-answers/): Button-only FAQ copy and unmarked lists vanish in Reader Mode; use headings and .yt-prose-list. - [The CRM is not the funnel](https://www.yellow-theme.com/proof/notes/the-crm-is-not-the-funnel/): People and deals in the CRM; weekly counters stay on the event store — match the ACL after cutover. - [The list omits the nested record](https://www.yellow-theme.com/proof/notes/list-omits-the-nested-record/): List returns companyId with company: null; hydrate by id before mapping HQ city. - [The Notes tab is a mirror](https://www.yellow-theme.com/proof/notes/the-notes-tab-is-a-mirror/): Structured fields stay the write path; upsert a titled Note so humans see the Notes tab. ## Legal - [Disclosure](https://www.yellow-theme.com/legal/disclosure/): What Yellow Theme will and will not claim — not the auditor, exact fees in the SOW, synthetic samples, and evidence packs that are not a live dashboard. ## Optional - [Sitemap](https://www.yellow-theme.com/sitemap.xml): Indexable pages. This file is the curated overview.