Agency white-label
For studios handing AI-built products to clients.
Who this is for
You deliver apps built with AI tools to clients and want an independent check before handover, without building a testing team.
The report carries your name; the method and the checklist are the same as on this site.
Built for agencies handing AI-built products to clients.
What we check
Six categories by default; payments and AI features added when the client project uses them.
Secrets and keys
API keys and passwords the app uses to talk to other services.
5 checks
Secrets and keys
API keys and passwords the app uses to talk to other services.
Data access
Rules that decide which user can read or change which rows in the database.
7 checks
Data access
Rules that decide which user can read or change which rows in the database.
- Firebase rules left in test modeCritical
- Record ids accepted without an ownership checkCritical
- Inverted policy logicCritical
- Any signed-in user can read every rowCritical
- Row Level Security disabled on a tableCritical
- RLS policy that allows everything with using (true)Critical
- Uploaded files in a public storage bucketHigh
Login and permissions
How the app knows who you are and what you are allowed to do.
7 checks
Login and permissions
How the app knows who you are and what you are allowed to do.
- Admin routes without any login checkCritical
- Authorization enforced only in the browserCritical
- Default admin credentials left in placeCritical
- Tokens trusted without server verificationCritical
- Role chosen by the client at signupCritical
- Password reset links that never expireHigh
- Sessions that survive logout and password changesHigh
Payments
Everything between the pay button and the money arriving.
5 checks
Payments
Everything between the pay button and the money arriving.
Reliability
Whether the app keeps working when something fails.
5 checks
Reliability
Whether the app keeps working when something fails.
Deploy and config
How code reaches production and how the server is configured.
8 checks
Deploy and config
How code reaches production and how the server is configured.
- AI agent with production credentialsCritical
- Builder project set to publicHigh
- CORS open to any origin with credentialsHigh
- Dependencies with known vulnerabilitiesHigh
- Debug mode left on in productionMedium
- Missing security headersMedium
- No automated checks before deployMedium
- Every change goes straight to productionMedium
Why these checks: seen in public
Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.
Oct 2025 · Escape · all sources
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
Each incident links to the pattern and the self-check you can run today, in the evidence list.
What you receive
- 01Pre-handover check per client project
- 02Report in your branding
- 03Volume terms
See a full sample report (synthetic, fictional app) for the exact format.
How it works
- Step 1
Share access
Send the app URL and a test login by email. For code review packages, add read access to the repository.
- Step 2
We test
We run the checklist for your package against the live app, by hand and with scripts, inside the turnaround.
- Step 3
Report and call
You receive the findings report and a plain-English summary. We walk you through it if the package includes a call.
- Step 4
Re-check after fixes
Fix with your developer or your AI tool, then we re-test the critical findings within the re-check window, included.
Findings describe what we observed on the version you gave us access to, on the date of testing. Changes after that date are not covered until re-checked.
Questions about the agency white-label
white label qa for agencies building with ai tools
We test each client project against the published checklist before handover and deliver the report in your branding. Pricing is per project on volume terms; ask for a quote with the stack and the number of projects per month.
can you test a lovable app before we hand it to a client
Yes. The agency white-label package runs the pre-launch checklist on the project and delivers a branded report you can include in the handover. Turnaround is agreed per project.
Order the agency white-label
quoted, report in per project. The email opens with a short template: app URL, builder, stack, what you want checked.
Other packages: Pre-launch check ($490), Security sweep ($290), Ready-to-charge check ($390). Compare all.