📊
63% had critical or high flaws
A scan of 62 Lovable apps found 63% carried critical or high severity vulnerabilities — an average of 10 findings each.
Fixed price · 48-hour turnaround
You shipped it in a weekend. Has anyone actually looked at it?
AI tooling made building fast. It did not make building safe. I review AI-generated apps — Lovable, Bolt, Cursor, Replit, Supabase — and hand you a plain-English list of what is actually wrong, with fixes you can paste straight into your editor.
- 400 apps studied: 59% had a critical issue
- 48h turnaround, fixed price
- Plain English, no jargon dump
Or skip the form: drop your project into the free browser scanner. It runs entirely on your machine — your code never leaves the page.
32
Do not ship yet
Ship readiness score
CRITICALYour Supabase service_role key is in the client bundle
CRITICAL7 tables have no row-level rules — anyone can read every customer row
HIGHEdge function reads the customer table without checking who is signed in
HIGH/api/debug returns other people's data
MEDIUMNo rate limit on the login route
+ paste-ready fix for each finding
This is a known problem, not a hypothetical
The pattern is consistent across independent studies of AI-built apps.
🔓
59% had at least one critical issue
Across 400 public repos built with Lovable, Bolt and v0, 18.5% had a committed .env file and 59% had a critical problem.
👥
Real customer data exposed
10.3% of sampled apps exposed live user data through missing row-level security. 98% of apps behind a public database URL had an exploitable flaw.
These are apps that got real users. The tooling's own scanner does not catch most of them — the platform's own team has said so publicly.
Ten checks. Every one of them has broken a real app.
Run automatically, judged by a human, explained without jargon.
01
Committed secrets
Is your .env in git? Has the database admin key ever been shipped to a browser?
02
Public database access
Your database URL and "public" key are meant to be public. I test whether strangers can actually read your tables with them.
03
Row-level security
Does every table actually restrict each customer to their own rows — or did the rule never get written?
04
Elevated database functions
Functions that run with database-admin rights are the classic way one customer reads another customer's data.
05
Who is actually signed in
Are admin pages and edge functions checking the person making the request, or trusting what the browser tells them?
06
Debug leftovers
Test routes, verbose errors and source maps that should never have shipped.
07
Token handling
Tokens that are decoded instead of verified, or accepted with a "none" algorithm.
08
Cross-origin access
Can any website in the world call your API and read the response?
09
Missing browser protections
The headers that stop the simplest attacks, and whether your site can be framed by another site.
10
Known-risky dependencies
Anything in your package list with a published advisory — and whether it is actually used.
Run the check yourself first. It is free.
The same scanner I use on paid reviews runs in your browser. Drop your project folder in, it reads the files locally, and nothing is uploaded anywhere — no account, no signup, no email address.
It checks committed secrets, row-level security on your Supabase tables, tokens accepted with no signature, wildcard CORS with credentials, debug routes left switched on, and environment files that are in git. It gives you a ship-readiness score out of 100 and a paste-ready fix for every finding.
Open the free scannerIf it finds something serious and you would rather have a person read it, say so — the same findings, ranked and explained, is the $199 review.
Pricing
Fixed price, agreed before I start. No hourly meter running in the background.
Start here
Security Sweep
$199fixed
- All 10 checks
- Prioritized findings report
- Paste-ready fixes for every finding
- 20-minute walkthrough video
- Delivered in 48 hours
Rescue
$599fixed
- Everything in the Sweep
- I implement the fixes
- Re-scan to confirm clean
- 5-day turnaround
Ship Check
$899fixed
- Everything in the Rescue
- Deployment hardening
- Written pre-launch checklist
- 60-min advisory, 8 weeks
What this is not: this is not a penetration test, not a compliance audit, and not a guarantee. It is a focused code and configuration review before you have to worry about a breach.
How it works
No sales calls. No 30-minute discovery. Four steps, 48 hours.
- You send access. A repo link, a zip, or your live URL. No credentials needed for most checks — and I never keep a copy of your code.
- I run the scan. Ten checks against your actual stack, not a generic checklist.
- I read the results. A scanner finds things. A person decides which ones matter and whether the fix will break your app.
- You get the report. Plain-English findings, ranked by what would hurt you most, each with a fix you can paste in. Plus a short walkthrough video.
Order a review
Tell me what you built and where it lives. You'll get a confirmation and a delivery date — and if I find nothing serious, I'll say so rather than invent work.
- Full scan of all 10 checks
- Findings ranked by real-world impact
- Paste-ready fixes, not vague advice
- Walkthrough video explaining each finding
- You own the report and every fix
Confidentiality: your code is never shared, never sold, never used as training data, and deleted on request after delivery.
Questions
Will you tell me to rewrite everything?
No. Most findings are one or two lines. The report tells you what to change and what to leave alone, ranked by what actually matters for your app.
What do you need from me?
A repo link with read access, a zip, or the live URL plus your explicit permission to test it. For database checks I may ask you to run one read-only query yourself — I never ask for production credentials.
Is this legal to do to my own app?
Yes — it is your app and you authorise every check. I never test a system without written authorisation, and the live checks send a single harmless read-only request.
Will you find something embarrassing?
Probably. That is the point, and nobody else sees it. The report is written to be handed straight to whoever needs to act on it.
What if there is a real, exploitable vulnerability?
I will tell you immediately and separately, ahead of the report, with the fix first. If it is being exploited right now, drop everything and rotate your keys first.
Do I need to fix everything before launch?
No. You get a ranked list so you can decide. Most teams fix the critical and high items and launch.
Can you help after the review?
Yes — that is the Rescue tier. I implement the fixes and re-scan to confirm, and you can go from Sweep to Rescue at any point.