Security review · Apps built with AI
Security review for AI-generated code and AI-built apps
Apps built with Claude Code, Cursor, Lovable, Bolt, v0, Replit and the like — checked on behalf of an owner who can’t read the code. AI makes building fast. But “who may see which data” is a rule of your business, and generating code does not decide it. Checking the code against that rule is the human part.
Pricing: Pre-launch light review From $210 / Spot review From $680 / Standard audit From $1,900 / Embedded fix From $4,800
Using AI is not the problem. What gets reviewed is not how the app was made but whether it handles other people’s data and money safely. And no one can promise “completely secure.”
What we check
What gets verified
Both kinds of problem: the ones whose answer is in the code, and the ones that only show up against your business rules.
Critical holes you can’t launch with
- Users can read or change other users’ data (missing ownership checks, RLS off or wrong)
- Exposed keys (API keys or service-role keys shipped to the browser)
- Payments processed twice, webhooks not verified
- An admin screen that any logged-in user can open
What code generation doesn’t decide
- Who may see which data (users, admins, other companies)
- How much data actually disappears when someone deletes their account
- Who files and images are visible to
- Whether the line between free and paid plans is enforced on the server, not just hidden in the UI
When
Cheapest and most effective: before real data goes in
Before launch, while you have a handful of users
The pre-launch review answers one question first: are there critical holes?
Before adding payments or file uploads
Money and files do the most damage when something is wrong, and cost more to fix later.
Before selling to companies
So you can answer their security team’s questions with evidence.
What it is not
- No “AI-built means unsafe” assumption. The app is held to the same standard as hand-written code.
- The pre-launch review is limited to whether critical holes exist. It is not an exhaustive audit.
- You never need to hand over key values or real customer data.
Who
Who reviews your app
Audits are taken on by Tomoda Hinata, a freelance full-stack engineer. Judge by the published research, tools and delivered work below, not by a title.
A field study of Supabase RLS (1,000 public repositories)
A static analysis of public repositories: 9.2% (91) of the 994 that ship RLS had a policy that checks sign-in but does not narrow rows to their owner — published after checking all 235 such policies by hand.
Aegis, an open-source security toolkit
Scanners and defensive building blocks for Next.js / Supabase, published under the MIT license. Part of the automated detection used in an audit is something anyone can run locally.
A METI Minister's Award–winning B2B SaaS (lumber distribution)
SoloAll 221 APIs with 0 missing-authorization findings, proven across 4 rounds of self-conducted security review (static review → live testing → penetration testing), with every critical finding, including cross-tenant personal-data exposure, fixed.
An internal AI platform for a broadcaster
TeamEncrypted personal data, audit logs, a WAF and key-less CI/CD built into the initial design rather than bolted on.
Pricing
What it costs
Start with the pre-launch review to find out whether critical holes exist, then move to a fuller review, an audit or the fixes if you need them. Prices are “from” anchors.
Pre-launch light review
Pre-launch or a handful of users — you want the obvious holes closed before launch
Turnaround: ~3 business days
From $210scoped per project
Spot review
Knowing your exact exposure before a release
Turnaround: ~1 week
From $680scoped per project
Standard audit
Shipping/operating a B2B, multi-tenant SaaS safely
Turnaround: ~2–3 weeks
From $1,900scoped per project
Embedded fix
Reaching “actually fixed, and it won’t regress,” not just detected
Turnaround: Scoped (a few weeks+)
From $4,800scoped per project
Every tier delivers its findings as fix instructions you can paste into Claude Code or Cursor. If you would rather have the fixes done for you, that is the remediation tier.
Frequently asked questions
Can I ask even though I can’t read the code?
Yes. The report explains every technical term in plain words, and each finding comes as a fix instruction you can paste into Claude Code or Cursor. A 30-minute call walks through what is risky and what is fine.
Isn’t running Claude Code’s /security-review enough?
It helps find problems whose answer is in the code, such as a hard-coded key or a classic injection. But whether user A may see user B’s data is not written in the code — it is a rule of your business. Checking the code against that rule is what a human review is for.
I turned on RLS for every table. Do I still need a review?
Turned on and correct are different things. In the author’s static-analysis study of 1,000 public repositories, 9.2% (91) of the 994 that shipped RLS had a policy that checks sign-in but does not narrow rows to their owner. Whether that is intended (data everyone may see) or a hole depends on what the app is supposed to do.
Can you review an app built with Lovable or Bolt?
Yes, as long as the code can be exported (connected to GitHub). If the database is Supabase, the RLS conditions are checked too.
How much does it cost?
The pre-launch review starts from $210 (about 3 business days). Fuller reviews, the standard audit and a remediation tier are also available. You can start with the free 20-question self-check to see where your worries are.
Do I need to hand over keys or customer data?
No. The code, the database structure (no data), a list of environment variable names, test accounts and a table of who may do what are enough to start.
One human look before you launch
First, a yes-or-no on critical holes in about 3 business days. Decide what to fix after that.
An NDA can be signed before our first call.