SECURITY FOR WHAT YOU SHIPPED / EST. FOR THE AI BUILD ERA
Your AI-built app is live.
Is your database open?
We audit apps made with Lovable, Cursor, v0 and Bolt. Every finding is verified by a second independent pass before it reaches you.
of AI-generated code samples introduced a security flaw.
VERACODE · 2025 GENAI CODE SECURITY REPORThigh-impact vulnerabilities found in 5,600 live vibe-coded apps.
ESCAPE.TECH RESEARCH · 2025of 1,645 Lovable apps in one study had their database access wide open.
LOVABLE APPS STUDY · 1,645 APPS01 — SCOPE
What we check.
Start at the surface. Go deeper when you need to know what happens after someone signs in.
| FREE SURFACE SCAN 01 | FULL AUDIT 02 |
|---|---|
| Security headers & TLS | Authenticated testing with two test accounts |
| CORS configuration | IDOR & access control |
| Exposed files | Privilege escalation |
| Secrets in the JavaScript bundle | Payment webhooks |
| Public database probes | Dependency CVEs & git-history secrets |
| Email records | Prompt injection |
| NO ACCOUNT ACCESS REQUIRED | INCLUDES THE SURFACE SCAN |
02 — METHOD
Find it.
Verify it.
Fix it.
A scanner can make a claim. A second independent pass checks whether it holds up.
Surface scan
Inspect what is exposed before signing in.
Authenticated testing
Test what two accounts can see and change.
Independent verification
Check each finding in a second pass before reporting it.
Report with proof & fixes
Get evidence, impact, and prompts you can use to fix each issue.
Retest within 30 days
For Full and Deep audits, we check the reported fixes again.
04 — PRICING
Pick the depth
you need.
One-time audits for a clear picture. Monitoring for a recurring look at the surface.
Free scan
For a first look at your public surface.
Public database probes
Quick Audit
For founders who need a verified surface report.
Human-verified
3 days
Full Audit
For apps with accounts, permissions, or payments.
Verified report
30-day retest included
Deep Audit
For teams who want help supervising the fixes.
Fix supervision
Monitoring
For founders who want to revisit the public surface.
Alerts
05 — QUESTIONS
The details,
plainly.
Is it legal to scan an app?
Only scan a site you own or have explicit permission to test. You must confirm permission before starting.
What do you need from me?
Your app URL and, for authenticated testing, two test accounts with appropriate roles. We’ll agree on the scope before testing.
How long does an audit take?
A Quick Audit takes 3 days. Timing for Full and Deep audits depends on the scope and is agreed in the brief.
What is in the report?
Each finding includes severity, business impact, evidence, and a practical fix. Findings receive a second independent verification pass.
How does the retest work?
Full and Deep audits include a retest of the reported fixes within 30 days.
What will you never do?
We do not touch production data. The free surface scan does not log in or extract data.