Full audit
For teams and startups who need a document, not just a list.
$1,900
Report in 5 business daysOrder by emailWe reply within 24 hours. Payment details follow by email.
Who this is for
Your codebase is now mostly AI-written, releases feel risky, and someone outside the team has asked for a security summary: an investor, an enterprise buyer, a partner.
You want a document you can hand over that says what was tested, what was found, what was fixed, and what remains, on a named date.
Built for teams whose code is now mostly AI-written, and startups before an investor or security review.
What we check
Nine categories; mobile is added when your app ships as a native app.
Secrets and keys
API keys and passwords the app uses to talk to other services.
5 checks
Secrets and keys
API keys and passwords the app uses to talk to other services.
Data access
Rules that decide which user can read or change which rows in the database.
7 checks
Data access
Rules that decide which user can read or change which rows in the database.
- Firebase rules left in test modeCritical
- Record ids accepted without an ownership checkCritical
- Inverted policy logicCritical
- Any signed-in user can read every rowCritical
- Row Level Security disabled on a tableCritical
- RLS policy that allows everything with using (true)Critical
- Uploaded files in a public storage bucketHigh
Login and permissions
How the app knows who you are and what you are allowed to do.
7 checks
Login and permissions
How the app knows who you are and what you are allowed to do.
- Admin routes without any login checkCritical
- Authorization enforced only in the browserCritical
- Default admin credentials left in placeCritical
- Tokens trusted without server verificationCritical
- Role chosen by the client at signupCritical
- Password reset links that never expireHigh
- Sessions that survive logout and password changesHigh
Payments
Everything between the pay button and the money arriving.
5 checks
Payments
Everything between the pay button and the money arriving.
AI features
Calls to a language model inside the app, and what they can trigger.
5 checks
AI features
Calls to a language model inside the app, and what they can trigger.
Reliability
Whether the app keeps working when something fails.
5 checks
Reliability
Whether the app keeps working when something fails.
Performance
How the app behaves when there is more data or more users.
4 checks
Performance
How the app behaves when there is more data or more users.
Data integrity
Whether stored data stays correct over time.
5 checks
Data integrity
Whether stored data stays correct over time.
Deploy and config
How code reaches production and how the server is configured.
8 checks
Deploy and config
How code reaches production and how the server is configured.
- AI agent with production credentialsCritical
- Builder project set to publicHigh
- CORS open to any origin with credentialsHigh
- Dependencies with known vulnerabilitiesHigh
- Debug mode left on in productionMedium
- Missing security headersMedium
- No automated checks before deployMedium
- Every change goes straight to productionMedium
Why these checks: seen in public
Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.
Oct 2025 · Escape · all sources
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
Each incident links to the pattern and the self-check you can run today, in the evidence list.
What you receive
- 01Full findings report across all categories
- 02Summary document suitable for an investor or enterprise security questionnaire
- 03Prioritised fix roadmap
- 0460-minute walkthrough call
- 05Re-check after fixes, within 30 days, included
See a full sample report (synthetic, fictional app) for the exact format.
How it works
- Step 1
Share access
Send the app URL and a test login by email. For code review packages, add read access to the repository.
- Step 2
We test
We run the checklist for your package against the live app, by hand and with scripts, inside the turnaround.
- Step 3
Report and call
You receive the findings report and a plain-English summary. We walk you through it if the package includes a call.
- Step 4
Re-check after fixes
Fix with your developer or your AI tool, then we re-test the critical findings within the re-check window, included.
Findings describe what we observed on the version you gave us access to, on the date of testing. Changes after that date are not covered until re-checked.
Questions about the full audit
investor due diligence code review startup
Investors and enterprise buyers usually ask for a security summary rather than a certificate. The full audit produces one: scope, method, findings by severity, fixes verified on re-check, and open items, on a named date. It is not a compliance attestation and we say so in the document.
what is the difference between a security sweep and a full audit
The security sweep covers three categories in 24 hours from the outside. The full audit covers nine categories over five business days with repository access, adds a summary document for third parties, a fix roadmap and a longer re-check window.
do you sign an nda before a code audit
Yes. Send yours or ask for ours when you order. Repository access is read-only and revoked when the re-check window closes.
Order the full audit
$1,900, report in 5 business days. The email opens with a short template: app URL, builder, stack, what you want checked.
Other packages: Pre-launch check ($490), Security sweep ($290), Ready-to-charge check ($390). Compare all.