Your AI-built app works. But is it safe to launch? We review apps built with Cursor, Lovable, Bolt or v0 the way a senior engineer would, and tell you exactly what to fix first.
Keys in the browser bundle, in Git history or in public env files.
Can a user see or change someone else's data? We try it.
Row-level security, storage buckets and Firestore rules that are switched off or too open.
Validation, rate limits, file uploads and the AI prompts your users can send.
Known vulnerabilities and abandoned packages the generator pulled in.
Duplicated logic, slow queries and hosting bills that grow with every user (Audit and up).
Fixed scope, fixed price, no hourly billing. Prices excl. VAT.
For a first launch or an MVP: the risks that hurt most, found fast.
For apps with paying users: security plus the code and costs behind it.
Before a big launch, funding round or enterprise customer.
One distinct page or view of your app, including its states (empty, loading, error). Modals and dialogs inside a screen don't count. Not sure? Send us the link and we'll count for you.
On request. Fixing is never part of a package: after the report you get a separate fixed quote. Many teams fix the findings themselves using our list.
We only need read-only access, sign an NDA on request and delete our copy after the report. We never test against production data without your written OK.
Apps from Cursor, Lovable, Bolt, v0, Replit and Claude Code, typically JavaScript or TypeScript with React, Next.js, Vue or Nuxt and Supabase, Firebase or a Node backend. Other stacks on request.
Yes, all three. Prices are fixed in each currency and exclude VAT.
Book a check today, get your report in 5 business days.
