Security audit of AI-built apps
Security audit for apps built with AI
AI tools build working apps fast. They also skip the parts nobody sees in a demo: access rules, secrets, rate limits and dependency checks. We check those, and fix them with you.
A security audit for AI-built apps is a focused review of an application created with Lovable, Bolt, Cursor, Replit, v0, Claude or similar tools, checking the issues these tools commonly leave behind: exposed API keys, missing database access rules, broken authentication, invented packages and missing rate limits. It is for founders and small teams about to launch or take payments. It starts at €1,500 and takes 3–5 days.
Who it is for
- Founders who built an MVP with Lovable, Bolt, Replit, v0, Cursor or Claude
- Small teams about to launch, take payments or store personal data
- Companies whose staff built internal tools with AI and now want to know if they are safe
- Investors or acquirers who want an independent look before a deal
Why now
- You are about to launch or start taking payments, and nobody has looked at the code except the AI
- Studies find security flaws in a large share of AI-generated code (Veracode found them in about 45% of samples)
- Your app stores personal data of EU users, and a leak would be a GDPR incident
- An investor, client or partner asked how you know the app is secure
What you get
- Secrets check: API keys and service tokens in the frontend bundle, the repository and its history, with a rotation plan
- Database access rules: for Supabase and Firebase, row-level security and rules tested with a real user and an anonymous one
- Authentication and authorisation tests: can a user read or change another user's data, or reach admin functions?
- Dependency review: packages that do not exist or were invented by the AI, typosquats and known vulnerabilities
- Abuse checks: missing rate limits on login, sign-up, email, AI and payment endpoints that cost you money
- Input and file handling: injection, unsafe uploads and server-side request issues in API routes and edge functions
- Findings report in plain language with the exact fix for each issue, and a short call to walk through it
- Fix support: prompts and patches you can apply with your own AI tool, and a re-check of the fixes
How it works
Access
You share the repository (or an export) and a test account. We do not need production data.
Review
We review the code and test the running app: secrets, database rules, auth, dependencies, abuse paths.
Report
A ranked list of findings in plain language, each with a fix. Critical issues are reported the same day.
Re-check
You or we apply the fixes; we re-test and confirm what is closed.
Why AI-built apps fail in the same places
AI coding tools are good at making features work. They are less reliable at the parts that only matter when someone tries to misuse the app. In practice, the same issues come up again and again:
- Keys in the browser. A service key with full database rights is put in frontend code because “it works”.
- No row-level security. Supabase tables are created without RLS policies, so any logged-in user, or anyone with the public anon key, can read every row.
- Auth that only hides buttons. The admin page is hidden in the menu, but the API behind it accepts any user.
- Hallucinated packages. The AI imports a package that does not exist, or a near-miss name. An attacker can publish a malicious package under that name.
- No rate limits. Sign-up, password reset, email sending and AI endpoints can be called thousands of times, which costs you money or gets your domain blocked.
A sample finding
Critical: any user can read all orders. The
orderstable in Supabase has row-level security disabled. Using the public anon key from the app’s JavaScript, we listed every order with customer names and addresses. Fix: enable RLS and add a policy that lets users select only rows whereuser_id = auth.uid(); test with two accounts; review access logs for bulk reads.
What we do not do
We do not rewrite your app or tell you to stop using AI tools. We use them ourselves. We check what they produced and help you put the missing guardrails in place.
Questions clients ask
Is my app secure if I built it with Lovable, Bolt or Cursor?
It might be, but you cannot tell from the outside. These tools produce code that works in a demo, and they often skip access rules, secret handling and rate limits. The only way to know is to test it, which is what this audit does.
How much does a security audit of an AI-built app cost?
From €1,500 excluding VAT for a typical single web app. You get a fixed price before we start.
How long does it take?
3–5 working days. If we find something critical, such as an open database or a leaked key, we tell you the same day instead of waiting for the report.
What are the most common issues you check for?
API keys shipped to the browser, Supabase tables without row-level security, users able to see other users' data, packages that the AI invented or misspelled, admin routes without checks, and endpoints with no rate limits that attackers can use to run up your bills.
Can I fix the problems myself with the same AI tool?
Often, yes. For each finding we give you a precise description and, where it helps, a prompt or patch you can use. We then re-check the result, because AI fixes sometimes close one hole and open another.
Do you need access to my production database?
No. We work with the code and a test account. If we need to check database rules, we use a staging project or test data.
Launching soon? Get it checked first
Tell us what you built and which tools you used. We will confirm the scope and price, and usually start within a week.