Production risk audits
An independent pass over the code your AI tools wrote, telling you what would hurt you first — in plain English, with fixes ready to paste.
The method is published. A senior engineer with 13 years in production signs every report.
BUILT FOR APPS MADE WITH
Lovable
Bolt€350
fixed price, plus VAT where it applies
48h
report, from the scheduled start
13 yrs
building and operating web products
0
trackers on this site
€430.50 including VAT. EU businesses with a valid VAT number pay €350 — reverse charge.
What goes wrong
Your app works, and real people are starting to use it. What follows is not exotic: each gap is documented behaviour of a platform you already use, meeting a line of generated code that did not account for it.
Your database hands out two keys: one meant to be public, one that opens everything. If the second is written into the part of your app that runs in people’s browsers, it goes out with every page load. A naming convention decides which keys travel, and anything starting VITE_ or NEXT_PUBLIC_ is published on purpose.
Your database can enforce who sees which rows, and that enforcement is off until somebody switches it on. Add a table through the Supabase dashboard and it is on. Add one the way these tools do, through a migration, and it stays off until the migration says otherwise.
A login screen is a door in the interface. Whether the data behind it is locked depends on the code that answers the request, and those are two different places. Nothing in the code looks wrong when they disagree, which is why no scanner finds it.
Your database gives out two keys. One is meant to be public. The other opens everything, and it belongs on a server.
.env
Whatever the app needs in order to run in a browser is copied into the file the browser downloads. A naming convention decides what gets copied.
vite build
The key is now inside the page. Every visitor downloads it, nothing takes it back, and you cannot tell who has already looked.
assets/index-a1b2c3.js
None of these companies has heard of me. They write this down because it keeps happening.
“Misconfigured RLS rules are a common cause of data leaks.”
“RLS must always be enabled on any tables stored in an exposed schema.”
“VITE_ variables should not contain sensitive information such as API keys.”
“Most vulnerabilities come from outdated libraries.”
AI-built apps tend to share the same five weaknesses. I check all five by name, every time — see what I check.
Several research teams have measured how often this goes wrong. I have not, and the evidence page carries both facts.
Two ways I can help
€350 + VAT · 48 hours
Your repository and your live app, read against a published standard. You get a written report: every problem found, what it costs you, and the fix, ready to paste into the tool that built it.
For apps built with Lovable, Bolt, Cursor or Replit.
from €1,800
I test your system, talk to your business, and give you a written answer: ready, or not ready — and why. The audit stops at findings; the Review makes the call.
For launches with real money, contracts or compliance on the line.
Not sure which? Start with the audit. The €350 counts in full toward a Review bought within 30 days.
The audit also carries a 7-day money-back guarantee: nothing useful in the report, full refund.
Tools and judgement
The first pass over your code is the check I published, free and open, and you can run it tonight without me. It will find real problems. Paying me starts where it stops.
A tool reads what is there. It cannot flag the alert nobody set up, the way back nobody built, or the part of the system nobody owns. Absence leaves no line to point at.
A tool can tell you an endpoint is open. It does not know who your customers are, what they pay you, or which of them leaves the week their data moves.
A list of findings is not a plan. Ordering them means knowing what you can realistically do this month, and which risks you are choosing to carry until then.
Much of the work is dismissal: the flag already handled somewhere else, the warning nothing can reach. And the reverse — two harmless things that are serious together, which only shows up to a reader holding the whole system at once.
And a tool is never wrong at its own expense. If the report gives you nothing actionable, you get the €350 back. That is the difference between an answer and a commitment.
Side by side
The first two columns are real options and cost nothing much. The last two are mine, and they only earn their price where the first two run out.
| Ask your AI | A $199 scanner | The audit | The Review | |
|---|---|---|---|---|
| Who does the checking | The tool that wrote the code | Pattern matching | A published method, signed off by an engineer | A senior engineer, by hand, with your business in the room |
| The question it answers | “Does anything look wrong?” | “Does anything match a known pattern?” | “What would hurt me first, and what would it cost me?” | “Can the business depend on this yet?” |
| What you are left holding | An answer in a chat window | An automated report | A written report, a page per finding, fixes included | A written answer: ready, ready with conditions, or not ready |
| Price | Free | About $199 | €350 + VAT | from €1,800 + VAT |
For the free column, the self-check page gives you the exact prompt. Just remember who is marking the work: the tool that wrote it.
From a real report
One page from the demo audit, shortened to fit here. If the file names at the top mean nothing to you, skip them: they are there so an engineer can check my work. The paragraph in the middle is the one written for you.
What I saw
src/lib/supabase.ts:5 — the Supabase service-role key, read into browser codedist/assets/index-*.js:95 — confirmed in the built bundle served to every visitor"role":"service_role" — decoded from the token itself, valid until 2034What it costs you if it triggers
Anyone who opens the site and presses F12 gets unrestricted read and write access to the whole database: every customer, every invoice, every account. No login, no exploit, no skill. And because the key is already published, you cannot know whether it has been taken — it has to be treated as compromised.
How to fix it
Rotate the key first; the published one is burned, and code changes are worthless while it still works. Then delete the browser-side admin client and move the four privileged operations behind server endpoints that check who is calling.
Paste-ready prompt
In this Vite + React + Supabase project, the Supabase service-role key is being exposed to the browser. Fix it as follows, and do not preserve any browser-side path to the service role. 1. In src/lib/supabase.ts, delete the supabaseServiceKey constant and the exported supabaseAdmin client…
After the AI applies it, check: rebuild, search the new bundle for the old key — it must be gone, and the app must still load on the anon key alone.
Every report ends with what the read could not reach — live configuration, dashboard settings, anything I could not open. That list is how you know which risks are still unmeasured, and it is the reason the report is worth reading to the last page.
How it works
Five questions about your app. No call.
If the audit fits, you get a start date. If not, I say so.
€350, only after the fit is confirmed.
Your code and configuration against the published method, then my review of what it found: what is real, what it costs you, and what to do first.
Findings, fixes, and 15 minutes on a call if you want it.
You know the price, the start date and the deadline before you pay.
Start here
If the audit is not the right fit for your app, you hear it before you pay, not after.