Contact
An app you built with AI starts with a free intro call (the Pre-launch light review starts at $210, scoped per project).
- I reply within 2 business days
- An NDA can be signed before our first call
- You never need to hand over key values or customer data
Q. Can I ask even though I can’t read the code?
A. Yes. The report explains every technical term in plain words, and each finding comes as a fix instruction you can paste into Claude Code or Cursor. A 30-minute call walks through what is risky and what is fine.
Q. Isn’t running Claude Code’s /security-review enough?
A. It helps find problems whose answer is in the code, such as a hard-coded key or a classic injection. But whether user A may see user B’s data is not written in the code — it is a rule of your business. Checking the code against that rule is what a human review is for.
Q. I turned on RLS for every table. Do I still need a review?
A. Turned on and correct are different things. In the author’s static-analysis study of 1,000 public repositories, 9.2% (91) of the 994 that shipped RLS had a policy that checks sign-in but does not narrow rows to their owner. Whether that is intended (data everyone may see) or a hole depends on what the app is supposed to do.
Q. Can you review an app built with Lovable or Bolt?
A. Yes, as long as the code can be exported (connected to GitHub). If the database is Supabase, the RLS conditions are checked too.
Q. How much does it cost?
A. The pre-launch light review starts from $210 (about 3 business days). Fuller reviews, the standard audit and a remediation tier are also available. You can start with the free 20-question self-check to see where your worries are.
Q. Do I need to hand over keys or customer data?
A. No. The code, the database structure (no data), a list of environment variable names, test accounts and a table of who may do what are enough to start.
If a form is not your thing, reach me directly at the address below.