You shipped it with an AI tool. We check it the way real users and real attackers will, and tell you what to fix in plain English.
For founders who built with an app builder, teams whose code is now mostly AI-written, and agencies handing AI-built products to clients.
Fixed prices. Report in hours. Written money-back term. What we cannot do.
Packages
For founders about to let real users in.
$490
For anyone who wants the three riskiest areas checked fast.
$290
For anyone about to switch Stripe to live mode.
$390
For teams and startups who need a document, not just a list.
$1,900
What breaks
Five of the 54 patterns in our public catalogue. Each has a self-check you can run today.
The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.
Seen in public: Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data. (Escape, 2025)
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
Seen in public: Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours. (Lovable, 2026)
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
Seen in public: One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login. (Taimur Khan, 2026)
Anyone who creates a free account can page through every other customer's records, which is a data breach with a sign-up form as the only step.
Seen in public: A scan of 1,645 Lovable-built apps found 170 (about 10.3%) with database endpoints readable without login because Supabase row-level security policies were missing or too broad; recorded as CVE-2025-48757, CVSS 9.3. (Matt Palmer (Replit, Inc.), 2025)
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
Seen in public: Apiiro's analysis of repositories at Fortune 50 companies found AI-assisted developers produced 3 to 4 times more commits and 10 times more security findings, with privilege escalation paths up 322%. (Apiiro, 2025)
The full catalogue
Secrets, data access, login, payments, AI features, reliability, performance, data integrity, deploy, mobile.
How it works
Send the app URL and a test login by email. For code review packages, add read access to the repository.
We run the checklist for your package against the live app, by hand and with scripts, inside the turnaround.
You receive the findings report and a plain-English summary. We walk you through it if the package includes a call.
Fix with your developer or your AI tool, then we re-test the critical findings within the re-check window, included.
The process in detail, including what access we need.
Free self-check
Up to nineteen questions chosen by your stack. You get the patterns that apply, most severe first, each with exact steps. Runs in your browser; nothing is sent.
What you receive
Page one is a summary a non-technical reader can act on. Then findings by severity, one page each, with mechanism, path, observed output and fix direction.
Synthetic: the app in the sample is fictional, and every page says so.
We tested Loamly the way a first wave of users and an opportunistic visitor would, using two test accounts and the public parts of the app. We found seven things worth fixing before launch: two critical, three high, two medium.
The two critical findings both let one user see or change another user's data. One is a database table with no access rules, so anyone with the app's public key can read every plant record. The other is a plan check that runs only in the browser, so a free user can reach paid features by editing one value.
Both critical fixes are small: turn on row-level rules for the plants table and move the plan check to the server. We describe the exact change for each finding and will re-test within 14 days of your fixes at no extra cost.
Why trust a company with no case studies
Email the app URL, the builder you used and what worries you. We reply within 24 hours with a recommendation and its price. No forms, no calls unless you want one.
Pick the package for your moment: pre-launch check before real users, ready-to-charge check before live payments, full audit before an investor or enterprise review, incident response check when something has already happened. Order by email; we reply within 24 hours and payment details follow by email.
Keys and secrets reaching the browser, database rules that let one user read another's rows, permission checks that run only in the browser, payment webhooks and plan enforcement, spend caps on AI features, error handling, and deploy settings. The full list is the failure catalogue, and every item has a self-check.
Our security sweep is $290 with a 24-hour turnaround; the pre-launch check is $490 in 48 hours; the full audit is $1,900 in five business days. All prices are on the packages page, with the money-back term.