Services / AI App Security Check
Is your AI-built app leaking data? Find out in a few days.
Apps built with AI tools often go live with open databases and exposed keys. We check yours, fix what's wrong and give you a plain-English report. €390 fixed.
Supabase · Firebase · Lovable · Bolt
✗ profiles table readable by any logged-in user✗ service key found in frontend bundle✗ backups not enabled✓ fixed RLS policies per user✓ fixed key moved, old key rotated✓ fixed daily backups, restore tested
Sound familiar?
Signs you need this
Your app was built in Lovable, Bolt, v0 or Replit
It stores user data in Supabase or Firebase
Real users have signed up
Nobody technical has reviewed it
The change
Before and after
| Before | After |
|---|---|
| Other users can read your users' data | Each user sees only their own rows |
| Secret keys visible in the browser | Keys on the server and rotated |
| No backups | Daily backups with a tested restore |
What you get
Deliverables
Database rules
Supabase row-level security or Firebase rules checked table by table.
Exposed keys
API keys and secrets found in the frontend or the repo, moved and rotated.
Login and permissions
Tests that one user can't see or change another user's data.
Payment checks
Stripe keys and webhooks set up safely, if you take payments.
Backups
Daily backups switched on and a restore tested.
Written report
What we found, what we fixed and what's left, in plain English.
How it runs
Four steps
- AccessYou share read access to the project and the app link.
- CheckWe test the app the way an attacker would.
- FixAgreed fixes made in your project.
- ReportReport and a 30-minute call to walk you through it.
What we need from you
- The app link and a test login
- Read access to your Supabase or Firebase project
- About 15 minutes to tell us what the app does
Proof
Done before, in production
- Defined the security model for a global distributed platform: OAuth 2.0, role-based access, least-privilege, secrets management
- Implemented enterprise login and SSO to compliance requirements
From our lead engineer's roles at larger companies. See Work.
Fit and price
A good fit if
- Apps built with AI tools that are live or about to launch
Not a fit if
- Formal penetration tests for compliance certificates
Price €390 fixed. 2–4 days. Included in the Launch + Secure package.
FAQ
Do I need to understand code?
No. The report is written for founders.
Will you change my app?
Only the fixes we agree on, and you'll see each one.
What if you find something serious?
We tell you the same day and fix it first.
Also useful
Tell us what you're building.
20 minutes, no pitch deck needed. You leave with a clear next step, even if it isn't us.