AI-built app audit before you launch or charge

It depends on what the assistant did in your particular project, which is why it's worth checking. Lovable and Supabase give you a solid base, but data security lives in settings the assistant can leave half done: row-level security policies (RLS), keys left in the frontend, or functions that never check who is calling them. An app can look and work perfectly with those doors open. The way to find out is to test it with two different accounts, which is what the audit does.

RLS (Row Level Security) is the Supabase and Postgres rule that decides which rows of a table each user can read or change. If it's off, or a policy says true, any logged-in user, and sometimes any visitor, can request every other user's records with a single query. It's like letting every customer open every other customer's drawer. You test it with two accounts: account A asks for account B's data and you see what the server returns.

Not necessarily. I prefer a staging environment or test accounts that you give me, and production only if you authorize it in writing. Read-only access to the repository is enough to read the code. Tests that could touch real data, such as replaying a webhook or repeating a payment, run in your payment provider's test mode.

It goes in the report marked critical, with its proof, its impact and the concrete fix, and on the call we decide the order to handle it. If there are critical findings, I give you a fixed quote to fix them; you can hire me, hand it to your own team or give it to anyone you like. The report is yours.

Yes. Your code and data are treated as confidential, and I sign an NDA if you ask for one. Testing happens only with your written authorization, which spells out what is reviewed, in which environments and on which dates.

I can review it anyway. The seven reviews apply to any app written by an AI assistant, or by a person in a hurry: Cursor, Claude Code, Windsurf, Copilot, or code someone else handed you. What changes is the stack: Supabase, Firebase, or your own backend in Node, Python or PHP. If it's over roughly 30,000 lines of your own code or it's several apps, I quote it separately.

The audit is US$490 at a fixed price and is delivered in 3 business days from the moment I have your authorization and test accounts. It covers one app: a frontend and its backend, up to roughly 30,000 lines of your own code. If I find nothing of medium severity or higher, I refund half. Fixing the critical findings starts at US$990 at a fixed quote, and maintenance at US$290 a month.

Not as part of the audit: I hand you the report and I don't change your code. If there are critical findings, the fix is quoted separately and covers what turned up, with proof that it no longer reproduces, without rebuilding what works. If the app has deeper problems that patches won't solve, the report says so, and the route from there is the legacy rescue.