Incident response check

For the day something has already gone wrong.

Within 24 hours we tell you what is reachable right now (keys, data, admin routes), give you containment steps in order, and deliver a findings report with fix directions. For a scary email from a user, a leaked key, or a suspicious spike in usage or spend.

$790

Report in 24 hoursOrder by email

We reply within 24 hours. Payment details follow by email.

Who this is for

Someone told you they can see other users' data. A key showed up somewhere public. Your model API bill jumped overnight. You need to know the exposure today, and what to switch off first.

We work from the outside first, so we can start the moment you send the URL and a test login. Repository access speeds up the second half.

Built for founders who built with an app builder, and teams whose code is now mostly AI-written.

What we check

Secrets, data access, auth and AI-feature spend: the categories that decide what is reachable right now.

Secrets and keys

API keys and passwords the app uses to talk to other services.

5 checks

Data access

Rules that decide which user can read or change which rows in the database.

7 checks

Firebase rules left in test modeCritical
Record ids accepted without an ownership checkCritical
Inverted policy logicCritical
Any signed-in user can read every rowCritical
Row Level Security disabled on a tableCritical
RLS policy that allows everything with using (true)Critical
Uploaded files in a public storage bucketHigh

Login and permissions

How the app knows who you are and what you are allowed to do.

7 checks

Admin routes without any login checkCritical
Authorization enforced only in the browserCritical
Default admin credentials left in placeCritical
Tokens trusted without server verificationCritical
Role chosen by the client at signupCritical
Password reset links that never expireHigh
Sessions that survive logout and password changesHigh

AI features

Calls to a language model inside the app, and what they can trigger.

5 checks

LLM API key exposed to the clientCritical
No output validation before actionsCritical
No spend cap on model callsHigh
Prompt injection through user contentHigh
Unbounded input length to the modelMedium

Why these checks: seen in public

Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.

Oct 2025 · Escape · all sources

Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.

Apr 2026 · Lovable · all sources

Each incident links to the pattern and the self-check you can run today, in the evidence list.

What you receive

01Immediate exposure assessment: what is reachable right now
02Containment steps in order
03Findings report and fix direction

See a full sample report (synthetic, fictional app) for the exact format.

How it works

Step 1
Share access
Send the app URL and a test login by email. For code review packages, add read access to the repository.
Step 2
We test
We run the checklist for your package against the live app, by hand and with scripts, inside the turnaround.
Step 3
Report and call
You receive the findings report and a plain-English summary. We walk you through it if the package includes a call.
Step 4
Re-check after fixes
Fix with your developer or your AI tool, then we re-test the critical findings within the re-check window, included.

Findings describe what we observed on the version you gave us access to, on the date of testing. Changes after that date are not covered until re-checked.

Questions about the incident response check

someone found a security issue in my app what do i do

Thank them, ask for the exact steps to reproduce, and do not argue. Then rotate any key they mention, check whether the same issue exists on similar tables or routes, and re-test. The incident response check does the assessment and containment order for you within 24 hours.

my supabase service role key was exposed what should i do

Rotate it in the Supabase dashboard now, redeploy so nothing still uses the old key, then check the logs for reads and writes you did not expect. The service-role key bypasses every table rule, so treat any data the app can reach as potentially read.

Order the incident response check

$790, report in 24 hours. The email opens with a short template: app URL, builder, stack, what you want checked.

Order by email

Other packages: Pre-launch check ($490), Security sweep ($290), Ready-to-charge check ($390). Compare all.