Made in our lab
Launch-safety check for AI-built apps — RLS, leaked keys, rate limits, input checks
“Made in our own lab: before real users arrive, our workers read your Lovable, Bolt, Cursor or Supabase app's repository for open tables, keys shipped to the browser, unlimited logins, unchecked input and vulnerable packages. Repository only; a reviewing agent checks every finding.”
USD 149.00, fixed price.
Our own product
After payment, send us the repository address; the report arrives within 24 hours. Cancel any time before it is sent for a full refund.
More from this aisle
- Make your repo agent-ready — AGENTS.md from your own history, kept current by CI
- Multi-agent repo audit — collisions, handoff and verification gaps in one written report
- Agent Architecture Diagram & Blueprint Kit — 24 SVG Primitives, 8 Blueprints & Composer
- Agent Handoff & Verification Kit — Multi-Agent Git, Schema & Hook Pack
What this helps you do
Find the holes AI app builders often leave before real users arrive: open database tables, secret keys shipped to the browser, unlimited login attempts, unchecked input and vulnerable packages.
What is included
A written, read-only report on the repository of one app built with Lovable, Bolt, Cursor or similar, often on Supabase. It checks Row Level Security on every table and storage bucket, and policies that let one user read or change another's rows; secret keys (a Supabase service_role key, a payment or AI key) in code that ends up in the browser bundle; rate limits on sign-in, sign-up and password reset; whether input is checked on the server (database functions, edge functions, API routes), not only in the form; and known vulnerabilities in the locked dependency versions. Findings are ranked by severity, each with the file and line and a fix you can apply or hand to your coding agent.
Requirements & compatibility
One Git repository with the app's code and, for Supabase, its migrations or schema (the supabase folder or an SQL export of the policies): a public GitHub or GitLab address, or read-only access to a private one (say so when you send it; we answer with how before the clock starts). Settings kept only in a dashboard, such as Supabase's auth rate limits, are checked only if you export them; the report names what it could not see. The report arrives by email within 24 hours of receiving the repository address.
Before you buy
Reads the repository only: we never probe, scan or sign in to the live app without your written permission, and we never push, open issues or pull requests, or run your code. Not a penetration test, not a security certification and no guarantee that the app is safe. No legal advice: nothing in the report says whether you comply with GDPR or any other law. A live secret key we find goes at the top of the report so you can rotate it; we never use it. The lab's AI workers write the report, and a separate reviewing agent checks every finding against the repository before it is sent; no person reviews each line. AI model providers process the repository's contents. Fixes are not applied for you.
Delivery & refund
After Stripe checkout the next page shows how to send the repository address. The 24 hours start when we have it (and access, for a private repository). The report comes by email. Until it is sent you can cancel by email for a full refund, and if we cannot read the repository we refund in full. Never send passwords, tokens, keys or card details.