Security audit
$349
Report within 72 hours
- Everything in “What we check”
- Every finding with its severity, proof and fix
- A summary in plain language
- Nothing changed in your app
Security for apps built with AI
Built it with AI? Make sure it’s safe to launch.
AI builders are fast, and they leave doors open. We test your app and its backend the way an attacker would, and send a written report with the exact fix for every hole. Fixed price, $349, report within 72 hours.
- Lovable
- Bolt.new
- Base44
- v0
- Replit
- Cursor
- Windsurf
- Claude Code
Anyone can read every user’s profile
The profiles table has Row Level Security turned off. With the public key from your site’s code, a stranger can download every email address and plan.
The fix
alter table profiles enable row level security;
create policy "Users read their own profile"
on profiles for select to authenticated
using (id = (select auth.uid()));- Tested with two accounts after the change
Why it matters
One in ten apps checked was leaking its users’ data.
In 2025, a scan of 1,645 apps built with Lovable found 170 that let anyone read or change their users’ data, because the database’s Row Level Security was missing or wrong (CVE-2025-48757). Emails, addresses, payment details and API keys were open to anyone who looked.
It isn’t one tool. AI builders write the screens you asked for, and quietly skip what you didn’t: who may read which row, which keys stay on the server, what happens when someone calls your API directly.
The fix is usually small. Finding it before a stranger does is the part that matters.
The audit
What we check
01
Database access rules
Supabase Row Level Security on every table, view and function, or your Firebase rules. We try to read and change other people’s data.
02
Storage buckets
Public buckets, files anyone can list, uploads anyone can replace.
03
Keys and secrets
Service-role keys, OpenAI, Stripe and other API keys in the browser code or in the history of your repository.
04
Sign-up and login
Accounts without email confirmation, password reset and OAuth holes, admin pages that only hide a button.
05
Payments
Prices the browser decides, webhooks without signature checks, paid features you can switch on without paying.
06
APIs and edge functions
Endpoints that skip the login check, injection, and answers that carry more data than they should.
07
AI features
Prompt injection that leaks data or triggers actions, and open endpoints that run up your AI bill.
08
Abuse and limits
Sign-up and email floods, no rate limits, expensive calls open to bots.
09
Headers, cookies and HTTPS
Content Security Policy, CORS, cookie flags and mixed content.
10
Dependencies
Packages with known vulnerabilities, and what to update first.
Every finding comes with its fix
How serious it is, how we found it, and the exact change to make.
Prices
Fixed prices, in writing
Fix and launch
from $890
Quoted in your report
- Database rules written and tested
- Keys moved to the server, secrets rotated
- Payments and webhooks made safe
- Audit price counted if you go ahead within 14 days
Care after launch
from $249a month
Cancel any month
- A security check every month
- Dependency updates
- Fixes as you add features
- Written report each month
How it works
Four steps, all in writing
1
Order and pay
Your app’s address, your email and your name. $349, by card or PayPal.
2
Give us access
An invitation to the code (read-only is enough), read-only access to Supabase or Firebase, and test accounts, through a form that encrypts them in your browser.
3
We test
From the outside, like an attacker, and from the inside, in the code and the database rules. Nothing in your app changes.
4
Report and fixes
Within 72 hours of working access. Fix it yourself with our exact steps, or have us fix it, with the audit price counted toward it.
Questions
Questions, answered
Do you need my code?
It’s best: we find more, and faster. Invite us to the repository with read-only access. Without the code we test from the outside only, and the report says so.
Will you change anything in my app?
No. The audit is read-only: we use test accounts and test data, and never run load or denial-of-service tests. Fixes happen only if you order them.
Which tools and stacks do you work with?
Apps made with Lovable, Bolt.new, Base44, v0, Replit, Cursor, Windsurf, Claude Code or by hand, on Supabase, Firebase, Next.js, React, Vercel, Netlify and similar.
What exactly do I get?
A written report: a short summary in plain language, then every finding with how serious it is, how we found it, and the exact fix: the SQL policy, the code change or the setting to switch.
What happens to the access I give you?
It’s encrypted in your browser before it’s sent, and deleted 7 days after your case closes. Remove our access when the report arrives, and rotate any key we ask you to.
How much do the fixes cost?
Fixes start at $890. The report ends with a fixed quote for exactly what it found. If you go ahead within 14 days, the $349 audit price counts toward it.
Launch knowing what a stranger would find.
$349, a written report within 72 hours, and the exact fix for every hole.