Question 1

Who is behind inreallab?

Accepted Answer

Ruslan Chapaev plus a compact team, with vetted contractors at peak load. Instead of claimed seniority: client projects (Tele2, the Government of the Republic of Mordovia) and an open price list — you can see what you're paying for before we even speak.

Question 2

How is inreallab different from an agency?

Accepted Answer

Two things. First, we build our own products alongside client work — your project is handled by the same team and the same process, production-grade from the first commit. Second, we publish prices instead of saying 'cost on request'.

Question 3

What does 'production studio' mean?

Accepted Answer

Neither an agency nor an indie shop. A small team building its own products and client projects in parallel. We test our own approaches on ourselves first.

Question 4

What is the '2-day audit'?

Accepted Answer

Our main entry point. From $3,700, two working days. You get a PDF with an architecture map, an OWASP review, a data-compliance checklist and a 90-day roadmap. After that you're free to walk away. If you carry on with us, the audit fee counts towards the next stage.

Question 5

What if the audit finds nothing?

Accepted Answer

You get a full refund. In practice we find at least 3–5 P1 issues even in mature products.

Question 6

Is giving you access to the code safe?

Accepted Answer

Read-only over a secure channel. A temporary account with no production access. The NDA is signed before we start. All auditors are Russian residents.

Question 7

Can it be extended beyond two days?

Accepted Answer

Yes — the full package ($6,200, 5 days) or the holding package ($15,000, up to 4 products).

Question 8

Do you take small projects?

Accepted Answer

We do. The price list starts at $300 — a starter landing page, a small store, one-off fixes. We have no 'we don't work below X' floor: if it makes sense, we take it. If we see the task is a one-off and a freelancer or a site builder serves you better, we say so instead of selling you more.

Question 9

Who owns the code, and how does handover work?

Accepted Answer

You do, from the first commit. Your repository, your secrets, your servers. Handover isn't deferred to the end — it has already happened.

Question 10

What's the stack?

Accepted Answer

Next.js 15 + React 19 + TypeScript in strict mode, Postgres or Supabase. Styling is our own CSS — no UI kits, no class generators. Deployment on Selectel / VK Cloud / Yandex Cloud (to satisfy Russian data-residency law). Payments through YooKassa. We change the stack to fit the task: we don't drag Next.js into a place where static files or 1C-Bitrix would do.

Question 11

How long does an MVP take?

Accepted Answer

6–8 weeks for a standard web service (auth, billing, a customer account, a basic admin panel). Anything custom is quoted after the audit.

Question 12

What does building a website cost?

Accepted Answer

A landing page from $300; a corporate site from $1,200 (Basic) or $2,400 (Pro); an online store from $1,100 for a small version and $2,400 for a mid-size catalogue; a cloud product MVP from $15,000. These are starting prices — the exact quote is fixed after a short brief. All 1545 items, each with the market range beside it, are in the open price list.

Question 13

How long does building a website take?

Accepted Answer

A corporate site takes 4–8 weeks, an online store 8–12, a product MVP 6–8. The deadline is fixed at the start together with the quote, and we hold it instead of letting it drift.

Question 14

How do I choose a web development contractor?

Accepted Answer

Look past the pretty portfolio at three things: who owns the code after delivery, whether there is a fixed quote, and what happens with support and handover. With us the code is yours from the first commit, the price is fixed, and the whole price list is public — compare it with the market before you call.

Question 15

What is an MVP and why do I need one?

Accepted Answer

An MVP is the smallest working version of a product, built to test demand before serious investment. Instead of building everything for six months and risking the budget, you launch the core in 6–8 weeks, collect real feedback and then grow what the market actually wants.

Question 16

What does SEO cost?

Accepted Answer

SEO is ongoing monthly work rather than a one-off service, and the range depends on your niche and competition. We count leads from organic search and their cost, not rankings. The exact quote follows a review of your site and its keyword base — the 'Marketing and traffic' section of the open price list has the detail.

Question 17

What does a code audit cost?

Accepted Answer

The 2-day technical audit starts at $3,700; the full package (5 days) is $6,200. As separate services: an express OWASP Top-10 check is $900–$1,900, an application security review $1,500–$4,400, a web application penetration test $2,300–$7,500. If you carry on with us, the audit fee counts towards the next stage.

Question 18

How does a pentest differ from a security audit?

Accepted Answer

An audit is static analysis of code and configuration against OWASP plus a manual review: it finds vulnerabilities on paper. A pentest is an active attempt to break into a running system, through to real access and privilege escalation. The audit answers 'what is wrong'; the pentest answers 'which of it is actually exploitable'. The 2-day audit does not include active pentesting — that is a separate service and requires separate written authorisation to test.

Question 19

Do I have to comply with Russian personal-data law?

Accepted Answer

If the site collects personal data — a form with a name, phone number or email — then yes. You need a privacy policy, a consent mechanism, storage on servers inside Russia and a notification to the regulator. We provide the checklist and document templates; formal certification goes through a licensed partner.

Question 20

Data-protection compliance — what do you do and not do?

Accepted Answer

We do: the checklist, document templates, and bringing in a licensed partner lawyer. We don't do ourselves: formal certification and filing with the regulator — that is the work of licensed auditors with official seals.

Question 21

Can I check your security track record?

Accepted Answer

We share the reports on our own products under NDA — they show both the findings and how we closed them. Client project reports only with the client's permission.

Question 22

Why fixed prices?

Accepted Answer

Hourly billing moves the risk onto the client. We know how long our work takes, size the scope up front and fix the price.

Question 23

How do I pay?

Accepted Answer

50% at the start, 50% on delivery. Bank transfer. Card · transfer · sole-proprietor contract · company contract. In rubles.

Question 24

Are there discounts?

Accepted Answer

A long contract (6+ months of social media, 12+ months of support) gets −15%. Take several services in sequence and the audit fee counts towards them.

Question 25

What's the warranty?

Accepted Answer

On development: 30 days of free fixes after launch. On pentesting: 30/60 days of re-testing after you've made your fixes. On the audit: 7 days of answering follow-up questions.

Question 26

How do I reach you if something goes wrong?

Accepted Answer

A direct Telegram chat with the project's tech lead. You talk to the people writing the code — no intermediaries, no ticket forms.

Question 27

Can you be our part-time CTO?

Accepted Answer

Fractional CTO — yes, that's open for discussion. From $3,500/month. It requires the audit first ($3,700, credited towards the work).

27 answers. To the point.

Ask us — directly.