Can strangers see or change your customers' data?
Many AI-built apps ship with database rules that let anyone read every user's records. We check every table.
Launch Check for AI-built apps
Is your app safe to launch?
You built it with Lovable, Bolt or another AI builder, and it works. Before real customers and real money arrive, we check the four things AI-built apps most often get wrong. You get a plain-English report in 3 days.
- Read-only review of what you share
- Written by a human developer
- Fixed price
- Customer data. Anyone can read every booking, including names and phone numbers.
- Secret keys. No secret keys found in the website code.
- Payments. Pro features unlock from the "thank you" page, not from Stripe's confirmation.
- Admin pages. /admin is hidden from the menu but opens without a login.
Fix prompt you can paste into Lovable
Read the full sample report →
"Enable Row Level Security on the bookings table and add policies so users can only see and edit their own bookings. Don't change other tables."
The four questions we answer
Are your secret keys sitting in your website's code?
If a secret key ends up in the browser, anyone can copy it and use your accounts.
Can people get your paid features without paying?
We check that access only unlocks after Stripe confirms the payment, not just because someone visited the "thank you" page.
Can anyone open your admin pages?
Hiding an admin button isn't the same as locking the page. We check that it's truly protected.
How it works
-
Order and share access
Pick a package and give us read-only access to your code (GitHub) and your Supabase project. It takes about 5 minutes, and we send step-by-step instructions.
-
We review
We review only what you've shared. Nothing in your app changes.
-
You get the report
Within 3 days: each area rated red, amber or green, with exact fixes, including prompts you can paste straight into your AI builder.
-
Fix it yourself, or let us
Use the prompts, or book a fix sprint and we'll do it for you.
Pricing
Intro pricing for our first clients.
Launch Check
$125
- Plain-English report covering all 4 areas
- Red, amber or green rating for each area
- Exact fixes, with prompts for your AI builder
- Delivered in 3 days
Check + Walkthrough
$225
- Everything in Launch Check
- 15-minute video walkthrough of your findings
- A prioritised fix plan
- Delivered in 3 days
Check + Fixes
$695
- Everything in Check + Walkthrough
- We fix up to 3 critical issues
- You approve every change before it goes live
- We re-check it afterwards · 7 days
Need more? Fix sprints start at $1,500. Care plans (a monthly re-check plus small fixes) start at $399/month.
Questions
Lovable and Supabase already have security checks. Why do I need this?
They're a great start, and we use their results too. But they don't check how your payments unlock features, whether your admin pages are truly locked, or how the pieces of your particular app fit together. And you get a person who explains every finding and how to fix it.
I'm not technical. Will I understand the report?
Yes. It's written for founders. Every finding says what's wrong, why it matters to your business, and exactly how to fix it.
Will you change anything in my app?
Not unless you order fixes. Reviews are read-only. With fixes, you approve every change before it goes live.
What do you do with my code and data?
We use them only for your review, keep them confidential, and delete our copies afterwards. We'll remind you to remove our access.
Is this a guarantee my app is secure?
No. It's a focused review of the four areas above at a point in time. That's where most launch problems come from, but it isn't a full penetration test.
Which apps do you work with?
Apps built with Lovable, Bolt, Replit, Base44, Cursor or by hand, as long as they use Supabase. Stripe is optional.
Launching soon? Check first.
Order through Fiverr, where your payment is protected until the report is delivered. Or email us first with any questions.