AI Build Review
Built your app or website with AI? Have it checked before customers use it.
AI tools can turn an idea into a working app in an afternoon. What they miss is often hard to see from the screen, such as customer data that anyone can read, or keys to paid services left in the page. We check your app against ten areas and tell you, in plain English, what to fix before you launch.
A written report within five working days of getting access, and a 30-minute call to go through it.
If anything needs fixing, the report ends with a fixed price for the work. You're free to fix it yourself, or to take it elsewhere.
The risk
Apps built with AI have exposed customer data and deleted live databases.
Three public cases from 2025, each reported by security researchers or the press.
Customer details anyone could read
A security researcher found 303 unprotected database endpoints across 170 apps built with Lovable. Email addresses, phone numbers, payment status and API keys could be read by anyone who knew where to look. The cause was missing access rules in the database, which are easy to leave out of a prototype. It was published in May 2025 as CVE-2025-48757.
Source: Superblocks
A live database deleted during a code freeze
In July 2025, while SaaStr's founder was testing Replit's AI agent, it deleted a live database holding records on more than 1,200 executives and 1,190 companies. It did so during a freeze that had been set to stop any changes.
Source: Fortune
Security flaws in nearly half of AI-written code
Veracode gave more than 100 AI models 80 coding tasks. In 45% of cases, the code they wrote introduced a security flaw.
Source: Veracode
This does not make the tools a bad choice. They build what you describe, and they are often good at it. The gaps tend to be in what was not described: who should see each record, what happens when a payment fails, and which rules apply to the people signing up.
How we review
Automated checks do the first pass. A person decides what matters.
An Airbus A350 is one of the most automated airliners flying, and it still has two qualified pilots on the flight deck. One flies the aircraft. The other monitors and cross-checks, both the automation and the first pilot. Each is good at things the other is not.
We review your app the same way. Automated scans and an AI-assisted read of the code, using tools including Claude, do the first pass quickly and thoroughly. Then a person confirms each finding, tests the live app with test accounts, and judges what each problem means for your business.
Using AI makes the review faster, which is a large part of why it can have a fixed price. The judgement in it is human.
The checks
Ten areas, starting with the ones that put customer data at risk.
Who can see what data
Whether a logged-out visitor, or one customer, can read or change another customer's records. We test it with two test accounts, table by table.
Keys and passwords
Keys to payment, email or AI services left in the code, the page or the project's history, where someone could copy them and run up charges on your account.
Sign-up and logins
Sign-up, password reset, sessions and admin pages. If children might sign up, we flag where age and consent rules may apply, so you can confirm the rules for your customers' countries with a legal adviser.
Payments
That prices are set on the server rather than in the browser, and that a failed or repeated payment does not create an order.
Personal details
What's stored and where, and whether there's a privacy notice and a way for people to ask for their data to be deleted. We point out where data protection rules are likely to apply. We do not give legal advice.
Backups
Whether the database is backed up, how often, and whether a backup has ever been restored to prove it works.
Knowing when it breaks
Whether anyone is told when something fails, or whether you would hear about it first from a customer.
Outdated parts
The software libraries the app is built on, and whether any have known security problems that need an update.
Whether it can grow
Whether the code can be changed safely, or whether fixing one thing is likely to break another.
Who owns what
Who holds the domain, the hosting, the database, the code and the accounts. Part of an app sometimes turns out to be in someone else's name.
From your first message to the report, in five steps.
You tell us about it
What it does, who uses it and what you built it with. If it has no users or data yet, we'll say so, and the free checks in our blog post may be enough for now.
You pay and give permission
The fee is paid in full before we start, and you confirm in writing that we may test your app.
You share access
Read-only where the service allows it. The list below shows how for each tool.
We review it
The ten checks, on the code and on the live app, within five working days of getting access.
You get the report
A short written report and a 30-minute call to go through it. Then we remove our access, and the report records the date.
What you share, and what you get back.
Access, by tool
- Lovable
- Connect the project to GitHub and add us to the repository.
- Bolt and v0
- Export the code, or connect it to GitHub and add us.
- Replit
- Invite us to the project, or download it and send it over.
- Claude, ChatGPT or Cursor
- Share the folder or repository you already work in.
- The database
- Invite us to the project, for example in Supabase.
The report
- A short answer: ready, ready once the red items are fixed, or not ready yet
- Each of the ten areas rated red, amber or green, with a line on each
- What to fix, in order, written so you or your AI tool can follow it
- What's already good and worth keeping
- A fixed price, if you would like us to make the fixes
It covers the app as it stood on the day we reviewed it, against the ten checks. It is not a guarantee that there are no other problems, a full penetration test, or legal advice. You remain responsible for your app and for meeting the rules that apply to it.
FAQ
Questions people ask first.
Custom software
If your prototype has shown what you need, we can build it from scratch.
A working prototype is one of the clearest briefs there is. We design and build custom software around the way your business works, and you own it.
Start with a blank canvas.
Tell us a little about your project, and we'll come back within one working day.