A fixed-price check of whether your app is ready for real users, with every problem ranked by risk and a fix plan you can act on.
Move over the app to X-ray it.
AI tools are good at screens. The problems sit underneath, where a demo never looks.
It happens to real products
The cause: a database key in the site’s code and no access rules on the database. Its founder said he’d built it entirely with AI. It’s exactly what an X-ray checks first.
Source: Wiz security research, February 2026Eight areas, every time. The report says exactly what was checked.
A written report with each finding ranked high, medium or low, what it means for your users in plain English, and what fixing it takes. Then a 30-minute call with me to walk through it.
| Finding | Risk | What it means for your users | Fix | Effort |
|---|---|---|---|---|
| Supabase service key in the front-end code | High | Anyone who opens the site can read and change every record. | Move the key to the server and rotate it | Half a day |
| No access rules on 6 of 9 tables | High | A logged-in user can read other users’ bookings and invoices. | Row-level security on each table, then test it | 1 to 2 days |
| Admin page checks the role only in the browser | Medium | Anyone who finds the admin address can open it. | Check the role on the server | Half a day |
| Payment webhook doesn’t verify signatures | Medium | A fake “payment succeeded” could unlock paid features. | Verify signatures and test end to end | Half a day |
| No database backups | Medium | One bad change to live data can’t be undone. | Daily backups and point-in-time recovery | 1 hour |
| 14 packages with known issues | Low | Low risk today, but they add up. | Update and retest | Half a day |
An example of the format. Your report covers your app, and nothing in it is generic.
From the first call to a decision in about a week.
30 minutes, free. Tell me what the app does and what worries you.
One fixed invoice through Payoneer or Wise, before the work starts.
To the code repository and the hosting and database dashboards. Remove it the day the report lands.
Every finding ranked high, medium or low, in plain English.
A 30-minute call to go through the report and answer questions.
Fix what’s there, rebuild the risky parts, or start clean. The fee comes off any fix or build within 60 days.
A penetration test or a security certification. It’s a production-readiness review by engineers, and the report says exactly what was checked.
We only review apps you own or are authorised to have tested.
Read access to the code repository and the hosting and database dashboards. You can remove it the day the report lands.
You get a report that says so, which is worth having before you show it to users or investors.
Lovable, Bolt, Cursor, v0 and Claude Code projects, plus anything on Next.js and Supabase.
Most apps are. If yours needs more time, we’ll tell you on the call, before you pay anything.
If you want us to. The fee comes off any fix or build within 60 days, and the report is yours to take to anyone.