Selected Engineering Work
x402Shield
Verified selected engineering work for Rust-based AI-agent, MCP-tool, and API-payment security.
View caseAI System & Model Security Review
From HK$61,900~US$7,880Reference date: 9 Oct 2026 · Local price is authoritative; this is not a payment or settlement rate.
Buyer outcome
A structured security review of an existing AI system or model deployment for Hong Kong businesses — covering data exposure, permission boundaries, prompt injection risk, output integrity, and governance gaps. Produces a written findings register with prioritised recommendations. Designed for professional services, financial operations, and compliance-aware teams reviewing AI deployments before widening rollout or presenting posture to clients or management. No deposit, invoice, or payment link is issued before written scope is confirmed.
Why a structured AI security review matters for Hong Kong deployments
AI systems deployed in professional services, financial operations, and compliance-adjacent environments in Hong Kong face specific security risks: confidential client documents accessible via prompt manipulation, AI outputs presented as authoritative to staff or clients without appropriate caveats, data flowing from sensitive internal systems into AI context without documented permission boundaries, and integration points that expand the effective access surface beyond what governance policy permits.
This review focuses specifically on data exposure risk where AI systems access more data than governance policy intended, prompt injection vulnerabilities where crafted inputs can extract information or alter AI behaviour beyond intended boundaries, output risks where AI-generated content is used in client-facing or decision-influencing contexts without human review, permission gaps where connected systems grant AI access beyond the scoped workflow, and governance documentation gaps that prevent the deployment from being audited, explained, or controlled by non-technical stakeholders.
BilgeQor's AI security reviews produce written findings with clear prioritisation. They do not provide guaranteed absence of vulnerabilities, PDPO certification, or legal opinion. Findings are scoped to the confirmed system boundaries and testing approach agreed in writing before the review begins.
Scope drivers
Number of AI systems or models in scope
System type — internal assistant, intake workflow, customer-facing, or API-integrated
Data sensitivity and access permission structure
Integration points — connected systems, APIs, data sources
Required testing depth — configuration review, prompt testing, output analysis
Governance and policy context to be reviewed alongside the system
Findings format and delivery requirements
Ideal for
- Hong Kong businesses with deployed AI systems that have not had a structured security review
- Professional services, financial operations, and compliance-adjacent firms reviewing AI before wider rollout or client presentation
- Technology teams that built or inherited an AI deployment and need independent findings and a written report
- Management teams that need a documented security posture for AI systems to present to clients, insurers, or board
- Teams that completed an integration or readiness engagement and now need a review cycle
What is included
- AI system scope and data context confirmation in writing
- Data exposure and permission boundary review
- Prompt injection and input abuse testing
- Output integrity and hallucination risk review
- Connected system and API access review
- Governance and usage policy gap assessment
- Written findings register with prioritised recommendations
- Review call and handoff notes
What is not included
- Penetration testing beyond AI system scope
- Legal advice or PDPO compliance certification
- Remediation implementation
- Ongoing monitoring or 24/7 security operations
- Full enterprise security audit
- Guaranteed absence of vulnerabilities
- Direct checkout or payment before written scope confirmation
Delivery process
1
System scope intake
Confirm AI systems in scope, data context, integration points, testing boundaries, and delivery expectations in writing before review begins.
2
Data exposure and permission review
Review data access patterns, permission structure, connected systems, and data handling boundaries for risk and exposure.
3
Prompt and output testing
Test for prompt injection susceptibility, output integrity issues, hallucination risk, and boundary adherence within confirmed scope.
4
Findings register and handoff
Deliver written findings register with prioritised recommendations, severity ratings, and a review call.
Representative deliverable
AI System Security Findings Register + Prioritised Recommendations
All AI services are request-first. Scope is confirmed in writing before any payment, deposit, or implementation commitment.
Frequently asked questions
Related evidence
Relevant Engineering work
Selected public case records related directly to this service scope. Each record keeps its attribution and disclosure boundary visible.