Security audits for Cursor · Claude Code · Lovable · Bolt · v0 · Supabase apps

Ship fast.
Don't ship your secrets.

A human-verified security audit for vibe-coded apps. We find leaked keys, open Supabase tables and unprotected endpoints, then hand you fix prompts to paste into your AI coding tool.

✓ Passive checks only · ✓ No card needed · ✓ Run by security practitioners: every paid finding human-verified

Checks forAPI key leaksSupabase RLSFirebase rulesMissing authOpen CORSSecurity headersDependency CVEs

The problem

AI writes the code. Nobody checks the locks.

🔑 Leaked keys

Service-role keys, OpenAI and Stripe secrets bundled into your public JavaScript where anyone can copy them.

🗄️ Open Supabase / Firebase

Missing Row Level Security or "allow all" rules that let anyone read or edit every user's data.

🚪 Missing auth

API routes that never check who's calling. Add open CORS, missing security headers and vulnerable dependencies.

What you get

What a human-verified audit includes

  1. Automated sweep: secrets in your repo, git history and live bundle; RLS and Firebase rules; CORS; headers; endpoints; dependency CVEs.
  2. Human verification: every finding is confirmed by hand. No false-positive noise.
  3. Plain-English report: what's wrong, what an attacker could do, ranked by business impact.
  4. Fix prompts: copy and paste into Cursor, Claude Code or Lovable to fix each issue.
  5. Re-test: once you've applied the fixes, we check again and confirm they're closed.

Example

Sample finding

CRITICAL Supabase table profiles readable without login

What it means: anyone with your public anon key (it's in your website's code) can download every user's name and email.

Evidence: an unauthenticated request returned 1,284 rows. Only the row count is recorded; no data is kept.

Fix prompt:

Enable Row Level Security on the "profiles" table in Supabase. Add a policy so
authenticated users can only SELECT and UPDATE rows where id = auth.uid().
Do not use the service_role key anywhere in client-side code.

Pricing

Pricing

Free Scan

$0

  • Instant passive scan of your live URL
  • Headers, CORS, secrets in your public JS
  • Exposed /.env and /.git
  • No account, no card
Run free scan

Launch Check

$49

  • Repo + live app, automated suite (semgrep, gitleaks/trufflehog over git history, osv/npm audit, trivy, nuclei, ZAP baseline)
  • Manual triage: no false-positive noise
  • Findings with CWE + CVSS 4.0 score
  • Fix prompts for Cursor / Claude Code / Lovable
  • Delivered in 48h · no logged-in testing
Buy Launch Check
Most thorough

Full Audit

$199

  • Everything in Launch Check
  • Authenticated testing with your test accounts
  • Supabase RLS / Firebase rules tested as anon vs user A vs user B (IDOR/BOLA)
  • Auth, sessions, JWT/OAuth, password reset, privilege escalation
  • Stripe webhook & payment bypass, SSRF, uploads, rate limits, AI/LLM prompt injection
  • Proof-of-concept for every High/Critical
  • Mapped to OWASP ASVS L1 (+ key L2), Top 10 & API Top 10
  • 1 free retest + attestation letter
Buy Full Audit

Prices in USD. Full Audit guarantee: if we find nothing rated Medium or higher, you get 50% back.

Free mini-scan

FAQ

What standards do you follow?

Findings are mapped to OWASP ASVS (Level 1, plus key Level 2 controls for the Full Audit), the OWASP Top 10 and API Security Top 10 (2023), the OWASP Top 10 for LLM apps, and CWE. Severity is scored with CVSS 4.0.

How does authorization work?

After purchase you sign a short authorization and rules of engagement (scope, testing window, exclusions), then prove ownership with a DNS TXT record or a /.well-known/sentinel.txt file. No active testing happens before both are done. For the Full Audit you provide two test user accounts (and an admin if you have roles). Staging is preferred.

What's the difference between Launch Check and Full Audit?

Launch Check covers your code, dependencies, secrets and the public surface of your app, with human triage. The Full Audit also logs in as different users and tries to reach data or actions they shouldn't. That's where the serious bugs in vibe-coded apps usually are (open RLS, IDOR, payment bypass).

Will testing touch my users' data?

We follow a minimal-proof rule: we prove access with row counts or column names, never bulk data. Testing is non-destructive. Write tests run only against test accounts or staging, and we stop and tell you immediately if we find something critical.

What's your refund policy?

Full refund any time before testing starts. For the Full Audit, if we find nothing rated Medium or higher, you get 50% back.

Is this a guarantee my app is secure?

No. An audit is a point-in-time, best-effort review of the agreed scope. It reduces risk but can't prove the absence of vulnerabilities.

How fast?

The free scan is instant. Launch Check is delivered in 48h. The Full Audit is delivered within 5 business days of authorization, and the retest within 30 days.

Consent & terms