- A person reads your code line by line.Tools are the backup, not the other way round.
- NDA on request. Read-only access.Access is removed when we are done.
- Every finding comes with proof and a concrete fix.Ranked by real-world risk, not by scanner score.
- Plain English for founders.Code-level detail for your developers.
- Checked against recognised standards.OWASP Top 10, OWASP ASVS and CWE.
- The engineer who finds the issues can fix them.No hand-off, no lost context.
Security audit for AI-built apps
You built it with AI. Let's make sure it's safe to launch.
A senior engineer reviews your AI-generated code, tests it the way an attacker would, and fixes what's broken before real users and real data arrive.
We audit apps built with
- Cursor
- Bolt
- Lovable
- Replit
- v0
- Claude Code
- Windsurf
- Copilot
Example findings
- CriticalService key exposed in the browser bundle
- HighDatabase rows readable by any logged-in user
- MediumNo rate limit on login
- Fix plan ready: 3 issues, every one with a fix
What your AI actually shipped
It works in the demo. That's not the same as safe.
AI tools optimise for “it runs”, not for “it can't be abused”. The reply sounds confident either way. Flip the switch to see what sits behind it.
AI assistantExample chat
Add login, a dashboard and Stripe payments
Done! Login, dashboard and checkout are all working ✨
if (user) showDashboard()
const STRIPE_SECRET = "sk_live_..."
// TODO: verify signature
GET /api/invoices/:idNothing flagged yet
- Looks fineBroken accessLogin is only checked in the browser
if (user) showDashboard() - Looks fineExposed secretSecret key hard-coded
const STRIPE_SECRET = "sk_live_..." - Looks fineUnverified inputPayment webhook trusts anyone
// TODO: verify signature - Looks fineData leakAny user can open any invoice
GET /api/invoices/:id
If nobody has read the code, nobody knows which of these your app has.
Get your app reviewedDeep scan
AI writes code that works. Not code that defends itself.
A full-stack review walks every layer of your app, from login to deploy, and flags what an attacker would find first.
AUTH
API
DATABASE
STORAGE
PAYMENTS
SECRETS
INFRA
DEPLOY
- AUTHRole check missing
- DATABASEOpen read access
- PAYMENTSUnsigned webhook
- SECRETSKey in client code
Illustrative scan of an example app. Four of eight areas flagged, to show how a review reads.
45%
of AI coding tasks produced code with a security flaw.
Veracode tested 80 tasks across 100+ AI models.
Source: Veracode 2025 GenAI Code Security ReportBigger ≠ safer
Newer, larger models were not meaningfully more secure.
Same study, same finding.
Source: Veracode 2025 GenAI Code Security ReportHuman eyes
A senior engineer reading your code catches what models and scanners miss.
Tools
What automated scanners catch
- Known-vulnerable packages
- Obvious secrets in the repo
- Common code patterns
Human
What a manual review adds
- Broken access control between users
- Business-logic abuse, like editing someone else’s order
- Auth flows that can be skipped
- Data leaking through your API responses
- Misconfigured storage buckets and database rules
Example · the moment
Any logged-in user could read every customer’s data.
Find it before someone else does.
Talk it through with a senior engineer who reads code for a living.
What we check
Eight layers. One launch-ready app.
One engagement covers everything between “it runs on my laptop” and “it’s safe with real customers”.
Layer 01
Security audit of AI-generated code
AI tools write code that works, not always code that is safe. We read what they produced, line by line, and flag what an attacker could use.
We look for
- Injection and unsafe input handling
- Hard-coded keys and leaked secrets
- Outdated or risky dependencies
- Insecure defaults left by the generator
You get
A prioritised list of security findings, each with a plain-English explanation and a fix.
Layer 02
Vulnerability & penetration testing
We try to break your app the way a real attacker would, safely, before someone else does.
We look for
- Cross-site scripting (XSS) and CSRF
- Broken access to other users’ data
- Exposed admin and debug routes
- Abusable forms, uploads and rate limits
You get
Proof of what can be exploited, with steps to reproduce so your team can verify each fix.
Layer 03
Code quality & architecture review
Generated code often piles up fast. We check that the structure will survive new features and a second developer.
We look for
- Duplicated and dead code
- Tangled components and no clear boundaries
- Missing error handling and tests
- Fragile data flow between modules
You get
A clear picture of how maintainable your codebase is, and what to refactor first.
Layer 04
Authentication & authorization checks
Who can sign in, and what each person is allowed to see. This is where many AI-built apps leak data.
We look for
- Session and token handling
- Role and permission checks on the server
- Password reset and social login flows
- Users reaching each other’s records (IDOR)
You get
A map of who can do what in your app, plus the gaps that need closing.
Layer 05
Database, API & infrastructure security
Your data lives behind your database, APIs and hosting settings. One wrong switch there can expose everything.
We look for
- Row-level security and open tables
- Unauthenticated or over-permissive API routes
- Public buckets and exposed env files
- CORS, headers and secrets management
You get
A configuration review of your backend with the exact settings to change.
Layer 06
Performance & scalability review
An app that is fine with ten users can fall over with a thousand. We find the slow spots before launch day does.
We look for
- Slow or repeated database queries
- Heavy bundles and render-blocking assets
- Missing caching and pagination
- Limits that break under real traffic
You get
The bottlenecks ranked by impact, with the changes that give the biggest speed-up first.
Layer 07
Production-readiness assessment
Running is not the same as ready. We check the unglamorous things that keep a live app up and recoverable.
We look for
- Logging, monitoring and error alerts
- Backups and a tested restore
- Separate staging and production settings
- Deploy, rollback and domain/SSL setup
You get
A go / no-go checklist for launch, with every open item named and owned.
Layer 08
Fixes & launch preparation
A list of problems is only half the job. We can fix the critical ones with you and get you over the line to launch.
We look for
- Patches for high-severity findings
- Re-test to confirm each issue is closed
- Hardened config and secrets rotation
- Handover notes your team can follow
You get
Fixed critical issues, a re-tested app, and a clear launch plan.
01 / 08
Common stacks we review
- Next.js
- React
- Supabase
- Firebase
- Node.js
- Python
- Postgres
- Stripe
- Vercel
- Netlify
- AWS
Book a free discovery call
Not sure which layers you need? That’s what the call is for.
How it works
From “is this safe?” to launch-ready, in five steps.
A clear path with a written scope up front. You always know what happens next.
The audit
- 1
Free discovery call
You walk us through the app and what’s at stake; we tell you honestly what it needs.
- 2
Scope & secure access
NDA on request, read-only repo access, a written scope before any work.
- 3
Audit & attack
Manual code review plus hands-on testing of the live app, the way an attacker would.
- 4
Report & walkthrough
Every finding ranked by severity, with proof and a fix; we go through it together.
- 5
Fix & launch
We fix the issues (or guide your team), retest, and sign off the launch checklist.
Sample report
Not a scary PDF. A plan you can act on.
Click a finding to see the proof and the fix. Then apply them and watch launch readiness climb.
Example report · illustrative findings
Audit report · your-app6 findings, ranked by severity
Launch readiness38/100
ProofKey found in the public JS bundle; it bypasses every row-level rule.
Fix
Move to a server-only env var; rotate the key; use the anon key client-side.ProofChanging the id in the request returns another account’s invoice.
Fix
Check invoice.userId === session.user.id before returning the row.ProofA forged POST marks an order as paid without any payment.
Fix
Verify the signature header against the raw body and reject on mismatch.ProofHundreds of password guesses per minute were accepted.
Fix
Add per-IP and per-account limits with backoff on repeated failures.ProofThe admin API answers a normal user when called directly.
Fix
Enforce the admin role on the server for every admin endpoint.ProofN+1 pattern: one query per row inside a render loop.
Fix
Fetch in one joined query and cache the result.
Quick self-check
Is your app ready for real users?
Eight quick questions. Nothing is sent anywhere: it all runs in your browser.
Question 1 of 8
Are all secret keys kept on the server only, with none in your frontend code?
env vars / service keysHow we work
A senior engineer, not just a scanner.
Automated scanners are fast and noisy. Real risk hides in how your app fits together, and that takes someone who reads it.
See real projects we've builtFAQ
Questions founders actually ask
Short, honest answers. If yours is not here, ask it on a free call.
Book a free discovery callMy app works fine. Why would I need an audit?
Working and being secure are different things. AI tools are very good at producing code that runs, so the app looks right when you test it. Security problems are usually invisible until someone deliberately tries to misuse the app, for example by reading data they should not see or skipping a payment check. An audit looks for those hidden gaps.
I'm not technical. Will I understand the results?
Yes. You get a plain-English summary that explains each finding, what it could mean for your customers or business, and what to do about it. We walk through the results on a call. If someone on your team maintains the code, they also get the technical detail they need to fix things.
Which AI tools and stacks do you review?
Apps built with tools such as Cursor, Bolt, Lovable, Replit, v0, Claude Code, Windsurf and GitHub Copilot. Common stacks include Next.js, React, Supabase, Firebase, Node.js, Python, Postgres and Stripe. If your stack is not on this list, ask on the discovery call.
What access do you need?
Read-only access to your code repository and a test account on your staging or live app. An NDA is available on request. We remove our access when the audit is finished.
Will you fix the problems, or just report them?
Either. We can fix the issues ourselves, or we can guide your team through the fixes. Either way, we retest afterwards so you know the fixes worked.
How long does it take, and what does it cost?
It depends on the size of your app and the scope of the work. You get a written scope and a quote after the free discovery call, so there are no surprises.
Is it safe to share my code with you?
Yes. An NDA is available on request, we only ask for the access the audit needs, and we do not share or reuse your code.
What if you find nothing serious?
Then you launch with evidence instead of hope. You still get the checklist, so you know what we checked and what to keep doing as the app changes.
Launch with confidence, not crossed fingers.
One call to find out what your app needs before your users find out the hard way.
Book a free discovery callFree call · No obligation · NDA on request