Agency white-label
Start hereFor studios handing AI-built products to clients.
quoted
per project
- Pre-handover check per project
- Report in your branding
- Same public checklist
- Volume pricing
- Optional client walkthrough
Before a client handover
Your studio built the app with AI tools, fast, and the client is happy with the demo. Handover is next week: their domain, their Stripe account, their users. Whatever is found after that will be found by their users and attributed to you. An independent check before handover is cheaper than a call three weeks later.
Written for agencies handing AI-built products to clients.
What to check first, in this order
Ordered by what a stranger reaches first. Each links to a self-check you can do today and to what our test adds.
- 01CriticalService-role key shipped in the browser bundle
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
- 02CriticalRow Level Security disabled on a table
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
- 03CriticalRecord ids accepted without an ownership check
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
- 04CriticalAdmin routes without any login check
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
- 05CriticalRole chosen by the client at signup
A visitor who edits the signup request, or updates their own profile, can make themselves an admin.
- 06HighStripe test keys in production
Customers can pay with Stripe's published test card numbers, the app fulfils the order, and no money ever reaches your account.
- 07MediumEvery change goes straight to production
A broken build, a bad migration or an agent's misjudged edit reaches real users and real data first, with no place where it could have been caught.
- 08HighNo backup that has ever been restored
When data is deleted or corrupted, whether by a bug, an agent or a person, there is either nothing to restore or a backup nobody has proven they can actually bring back.
- 09MediumMissing security headers
Without these headers a browser will happily load the app inside someone else's page, over plain HTTP, or with injected scripts, which turns an otherwise small bug into a working attack.
What happens without checking
One education app built on an app builder was found to have 16 vulnerabilities including an access check written backwards, exposing the records of its users (Taimur Khan, 2026). The researcher found it from the outside. A handover check does the same thing before the client's users can, and the first patterns below are the ones it starts with.
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login.
- 16 Vulnerabilities found
- 6 Critical
- 18,697 User records exposed
- 14,928 Unique email addresses
- 870 Enterprise users with full PII
Feb 2026 · Taimur Khan · all sources
A scan of 1,645 Lovable-built apps found 170 (about 10.3%) with database endpoints readable without login because Supabase row-level security policies were missing or too broad; recorded as CVE-2025-48757, CVSS 9.3.
- 1,645 Apps scanned
- 170 Apps with inadequate RLS
- 10.3% Share of scanned apps
- 303 Exposed endpoints
- 9.3 Critical CVSS 3.1 base score (CVE record)
- 8.26 Researcher's own CVSS base score
- 2025-03-21 Scan date
- 2025-05-29 Public disclosure
May 2025 · Matt Palmer (Replit, Inc.) · all sources
Which package
Pre-launch check
For founders about to let real users in.
$490
Report in 48 hours
- Keys and secrets in the browser or repo
- Who can read and change whose data
- Login, roles and admin routes
- Errors, retries and rate limits
- Debug mode, headers, deploy path
Compare all packages, or run the self-check first.
Questions
what should an agency check before delivering an ai built app
Secrets out of the bundle and repository. Row rules on every table. Ownership checks on record ids. Admin routes protected. Roles not chosen by the client at signup. Live keys only in the client's environment. A deploy path with a staging step, a tested restore, and headers. The agency white-label package runs this list and delivers the report in your branding.
can we include a security report in the client handover
Yes. Our report states scope, date, findings and fixes verified on re-check. It is written for a non-technical reader first, so the client's team can read it without you in the room.
Other moments: before you launch, before you take payments, before an investor or security review, after something went wrong, you received a security email.