A practical review of your AI-built code before launch

What this is not

This is not a formal security audit, a penetration test, or a compliance review for SOC 2, HIPAA or PCI. We don't issue certificates or attestations. If your app handles health records, payment card numbers or other regulated data, you need a security specialist, and we'll tell you so.

Instead, we check the code for the problems below.

What we look at

• Access. Can one user read or change another user's data? Are admin actions checked on the server, or only hidden in the interface? Are database rules, such as Supabase RLS policies, switched on and correct?
• Secrets. API keys in the repository, in its history, or shipped to the browser.
• Payments. Webhook signature checks, duplicate events, and what happens when a card fails or a subscription is cancelled.
• Data. How the schema changes over time, whether backups exist, and whether you can delete a user's account.
• Failures. Errors that are caught and ignored, missing logs, and whether anyone finds out when something breaks.
• Deploys. How the app gets built and released, whether test and live settings are separate, and whether you can roll back.
• Cost exposure. Calls to paid services, such as AI models, SMS or email, that anyone could trigger without limit.
• Unfinished work. Mock data, stub functions and features that look done in the interface but aren't connected to anything.

What you get

A written list, sorted into three groups: fix before launch, fix soon, and fine for now. Each item says where the problem is, why it matters, and roughly what fixing it involves.

You can hand that list to your AI tool, fix things yourself, or ask us to do the work as a fixed-scope project. We'll agree the price of the review before we start.

If you'd like to check the basics yourself first, start with the security checklist and the production checklist.