Pre-launch check

For founders about to let real users in.

We test your app the way a first wave of real users and an opportunistic attacker would. We look at keys and secrets, who can read whose data, login and permissions, what happens when things fail, and how code reaches production. You get a findings report, a one-page summary in plain English, a fix direction for every finding, a call, and a re-check after your fixes.

$490

Report in 48 hoursOrder by email

We reply within 24 hours. Payment details follow by email.

Who this is for

You built the app with Lovable, Bolt, Replit, v0, Base44 or a coding agent, it works, and the next step is real people using it. You want someone who is not you to try to break it first.

You do not need to know what RLS or a service-role key is. The report explains each finding in one paragraph a non-engineer can act on, and a second paragraph your developer or your AI tool can work from.

Built for founders who built with an app builder.

What we check

Five of the ten categories in the failure catalogue, chosen for what breaks first when strangers arrive.

Secrets and keys

API keys and passwords the app uses to talk to other services.

5 checks

Data access

Rules that decide which user can read or change which rows in the database.

7 checks

Firebase rules left in test modeCritical
Record ids accepted without an ownership checkCritical
Inverted policy logicCritical
Any signed-in user can read every rowCritical
Row Level Security disabled on a tableCritical
RLS policy that allows everything with using (true)Critical
Uploaded files in a public storage bucketHigh

Login and permissions

How the app knows who you are and what you are allowed to do.

7 checks

Admin routes without any login checkCritical
Authorization enforced only in the browserCritical
Default admin credentials left in placeCritical
Tokens trusted without server verificationCritical
Role chosen by the client at signupCritical
Password reset links that never expireHigh
Sessions that survive logout and password changesHigh

Reliability

Whether the app keeps working when something fails.

5 checks

Deploy and config

How code reaches production and how the server is configured.

8 checks

AI agent with production credentialsCritical
Builder project set to publicHigh
CORS open to any origin with credentialsHigh
Dependencies with known vulnerabilitiesHigh
Debug mode left on in productionMedium
Missing security headersMedium
No automated checks before deployMedium
Every change goes straight to productionMedium

Why these checks: seen in public

Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.

Oct 2025 · Escape · all sources

Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.

Apr 2026 · Lovable · all sources

Each incident links to the pattern and the self-check you can run today, in the evidence list.

What you receive

01Findings report with severity, mechanism and affected path
02One-page summary written for a non-technical reader
03Fix direction for every finding, usable with your developer or your AI tool
0430-minute walkthrough call
05Re-check of critical findings after your fixes, within 14 days, included

See a full sample report (synthetic, fictional app) for the exact format.

How it works

Step 1
Share access
Send the app URL and a test login by email. For code review packages, add read access to the repository.
Step 2
We test
We run the checklist for your package against the live app, by hand and with scripts, inside the turnaround.
Step 3
Report and call
You receive the findings report and a plain-English summary. We walk you through it if the package includes a call.
Step 4
Re-check after fixes
Fix with your developer or your AI tool, then we re-test the critical findings within the re-check window, included.

Findings describe what we observed on the version you gave us access to, on the date of testing. Changes after that date are not covered until re-checked.

Questions about the pre-launch check

is my lovable app safe to launch

Nobody can answer that from the outside without testing. The pre-launch check runs the checks that matter most before launch: exposed keys, data access rules, login and permissions, failure behaviour and deploy settings. You get the findings within 48 hours and a re-check after fixes.

what does a pre-launch check include

Secrets, data access, auth, reliability and deploy categories from the failure catalogue, tested against your live app with a test login. The report lists every finding with severity, mechanism, affected path and a fix direction, plus a one-page plain-English summary.

do i need to give you my source code

Not for this package. We test the live app with a test account and, where relevant, the public parts of your project (the JavaScript bundle, public API responses). Repository access lets us find more, and you can grant read-only access if you want that.

how long does a pre-launch check take

48 hours from the moment we have access. Payment details follow by email after you order; we reply within 24 hours.

Order the pre-launch check

$490, report in 48 hours. The email opens with a short template: app URL, builder, stack, what you want checked.

Order by email

Other packages: Security sweep ($290), Ready-to-charge check ($390), Full audit ($1,900). Compare all.