Leaked keys
Secrets in client code, the repo, or build output.
Security scan for AI-built apps
Is your AI-built app safe to ship?
A point-in-time security check for apps built with Lovable, Cursor, Supabase, Neon, or Vercel. It covers leaked keys, open routes, missing row-level security, and unsigned Stripe webhooks, with a written report ranked by risk within 3 business days. From $99. It is not a penetration test.
From $99Report in 3 business daysRead-only access
scan · your-appScanning
app/api/checkout/route.tsapp/api/webhooks/stripe/route.tslib/db.ts.env.examplesupabase/migrations/001_init.sqlcomponents/Admin.tsxnext.config.jsmiddleware.tsapp/admin/page.tsxlib/ai/client.ts
API key found in client code
Admin route open without auth
Row-level security missing on 2 tables
What I check
The four mistakes that sink AI-built apps
Open routes
API and admin routes anyone can call without signing in.
Missing row-level security
Database tables where one user can read another user’s data.
Unsigned Stripe webhooks
Payment events your app trusts without checking they came from Stripe.
This is a point-in-time check of the code and settings you share, not a penetration test. It finds common, high-impact mistakes. It does not prove an app is secure.
Order
Pick a scan
Pay online and share your repo, or send the details first. Both work.
How it works
Four steps
01
Pay
Order online. No call needed.
02
Share access
Send your repo URL and read-only access.
03
Get the report
A plain list of what I found, ranked by risk, within 3 business days.
04
Fix it
Fix it yourself, or have me do it with a rescue.
Questions about the security scan
What does the security scan check?
I check the four mistakes AI coding tools make most often: API keys or secrets exposed in client code, the repo, or build output; API and admin routes anyone can call without signing in; database tables missing row-level security; and Stripe webhooks your app trusts without verifying the signature. You get a written report ranked by risk.
How much does the scan cost, and what is the difference between the two options?
The security scan is $99 and covers all four checks with a written report ranked by risk. Scan plus a fix PR is $249. You get the same scan and report, plus a pull request from me that fixes the most serious finding, so the biggest risk is handled without extra work on your side.
How long does it take to get my report?
You get the report within 3 business days of sharing your repo URL and read-only access. It is a plain list of what I found, ordered by risk, with what to fix first. If you picked the fix PR option, the pull request for the most serious finding comes with it.
What access do you need to my code?
I need your repo URL and read-only access, nothing more. I do not need write access, production credentials, or admin rights to your hosting account for the scan. If you choose the fix PR option, I open a pull request that you review and merge yourself, so you stay in control of every change.
Is this a penetration test, and does it prove my app is secure?
No. It is a point-in-time review of the code and settings you share, focused on common, high-impact mistakes in apps built with AI tools. It is not a penetration test, and it does not prove an app is secure. It is a fast way to find and fix the problems most likely to hurt you first.
Which platforms and tools does the scan cover?
The scan is built for apps made with tools like Lovable, Cursor, Supabase, Neon, and Vercel, including Next.js apps that use Stripe. If your stack is close to that, it will fit. If you are not sure, send the details through the contact form before you order and I will tell you honestly.