Book a check

It works.
But is it safe to launch?

A 48-hour, 36-point production readiness check for apps built with Lovable, Bolt, Replit, v0 or Cursor. Fixed price. A report you can actually read — not a terminal dump.

Book a check — $199 See a sample report

No call required to start. Send a URL, get the report in 48 hours.
Not ready to book? Run the same 36 checks yourself — the checklist is free.

98%of 1,072 scanned AI-built apps had at least one security flaw
16%had a critical one — anyone could read or change user data
308exposed their database key in the browser
172allowed data deletion with no authentication at all

Source: Symbiotic Security scan of 1,072 Supabase-backed apps built on Lovable, Bolt, Replit, v0 and Windsurf.

The gap nobody warns you about

AI tools got you to a working app remarkably fast. What they quietly skipped is everything between "it works on my screen" and "strangers are using it with real data."

The database is often wide open

Row Level Security is off by default on new tables. Your app looks locked because the UI hides things — the database doesn't.

Payments look fine until they aren't

Unverified Stripe webhooks mean anyone can tell your app a payment succeeded. The money never arrives.

Validation lives in the wrong place

If the only check is in the form, it isn't a check. Requests don't have to come from your form.

How it works

  1. You send a URL

    Plus read access to the repo and database if you have it. If you don't, the external-only check still covers a lot.

  2. I run the checklist

    Automated scans plus a manual pass across 36 checkpoints. Every finding is verified by hand before it goes in the report.

  3. You get the report in 48h

    Findings ranked by severity, with the exact file, what breaks, and an estimate of how long each fix takes. Plus a 30-minute call to walk through it.

What gets checked

36 checkpoints across five areas. The full list ships with the report — nothing is hidden behind the invoice.

Access & data

  • Row Level Security on every table
  • Keys and secrets exposed in the browser bundle
  • Service-role keys reaching the client
  • Secrets committed to git history
  • Admin routes reachable without a session

Money & integrations

  • Stripe webhook signature verification
  • Prices trusted from the client side
  • Third-party API keys called from the front end
  • Email and file upload abuse paths

Correctness

  • Server-side input validation
  • Multi-tenant isolation — can user A see user B?
  • Error handling and what errors leak
  • Rate limiting on expensive endpoints

Launch readiness

  • Backups and whether a restore actually works
  • Security headers, HTTPS, CORS
  • Vulnerable dependencies
  • Account and data deletion paths
  • What happens at 100× today's traffic

AI products & widgets

  • Widget origin binding
  • Isolation between locations
  • Messenger webhook verification
  • Prompt injection resistance
  • Data retention
  • Product-promise stress test

Pricing

Fixed price on the check. Anything beyond it is quoted only after I've seen the actual scope — so neither of us is guessing.

External Check

$99
no repo access needed · 24h
  • Everything visible from outside
  • Exposed keys, headers, open endpoints
  • Short written report
Start
Most booked

Production Readiness Check

$199
full 36 points · 48h
  • All 36 checkpoints
  • Findings ranked by severity
  • Exact files and fix estimates
  • 30-minute walkthrough call
  • One free re-check after you fix
Book it

Monthly Watch

$149
per month · cancel anytime
  • Monthly re-scan
  • Dependency updates
  • Uptime monitoring
  • 2 hours of small fixes
Start

Fixes are quoted separately once the report exists, in stages, so the scope is always visible before you commit.

What this is not

Being straight about the boundaries is cheaper for both of us than discovering them later.

  • This is not a penetration test and not a certified security audit. It's a structured readiness review against a published checklist.
  • This is not GDPR compliance certification. I'll flag the obvious gaps; the legal opinion has to come from a lawyer.
  • Nothing gets attacked. I only inspect what you've given me access to. No probing, no live exploit attempts — ever.
  • No guarantees against being hacked. Anyone promising that is selling you something. This finds the known, common, high-impact failures — which is where nearly all real incidents start.

Questions

I built it myself with AI. Will you tell me it's garbage?

No. Most of these apps are genuinely good at what they do — the gaps are in the boring parts the tools skip by default. The report is a list of specific fixes, not a review of your abilities.

Can I fix things myself after the report?

Yes, and plenty of people do. Every finding includes the file and what to change, written so you can hand it straight to your AI tool. One free re-check is included so you can confirm it actually worked.

What if you find nothing?

Then you get that in writing, which is worth having before a launch. It has happened in about 2% of scanned apps — so plan for findings.

What do you need from me?

The live URL, read access to the repo, and read access to the database dashboard. If you can only give the URL, take the External Check instead.

How fast can you start?

Usually same or next day. The 48 hours starts when access lands.

Who’s behind this

{PLACEHOLDER — I’ll write this}

Find out before your users do

Send the URL. If there's nothing worth fixing, I'll tell you that in the first reply and you keep your $199.

Or email hello@itworksbut.com