Claude Code / Cursor / Lovable / v0 / Bolt
“It works. I just don't know if it's safe to launch.”
You built a real app with AI. That is genuinely impressive. But AI tells you when something runs — not whether strangers can read your users' data, whether someone gets charged twice, or whether you can roll back when it breaks. This page exists to close exactly that gap. Start with the free 20-question check.
No signup, and nothing you type leaves your browser.
How people usually arrive here
If any one of these sounds familiar, this page is probably useful
These are all things people actually say. None of them are embarrassing, and none of them are a skill problem. They come from a structural fact: there are things AI will not write unless you ask.
“ChatGPT told me to enable RLS. I don't know what that means or how to do it.”
RLS is the database setting that decides who can read which rows. Without it, anyone who knows your app's URL can read every user's data. The database section of the self-check starts by showing you how to find out what your current state is.
“I asked the AI to fix it and something else broke. I've lost track of what's correct.”
AI optimizes for satisfying the instruction in front of it, not for whole-system consistency. Writing down what must never break is human work. That's where we start.
“It's already live and people are using it. It feels too late to say I'm worried.”
It isn't too late. Having real users actually favours the approach of closing gaps in priority order. You don't have to take anything down.
“I want to ask an engineer, but I don't know what to ask.”
That's fine — I'll ask the questions. We can start from you sending a URL; I'll walk you through sharing the repository.
“My bill suddenly jumped, and I'm scared of what happens if usage grows.”
Usage-billed services spike easily on unexpected traffic or an accidental loop. Setting caps and alerts, and finding the endpoints that spike, is one of the highest-value things to do right after launch.
“I'm the only one who understands it. If something happens to me, nobody can fix it.”
Being handover-ready is itself an asset. Writing down just three things — where everything lives, where the keys are, and how to roll back — changes the picture considerably.
Nobody here is going to tell you that building it with AI was the mistake. I write production apps with Claude Code every day.
Why this keeps happening
Measured evidence that this is not just you
All primary sources, each linked below.
45%
of AI-generated code samples contained a security flaw
Across 80 coding tasks and more than 100 large language models, 45% of generated samples introduced an OWASP Top 10 vulnerability. Defences against cross-site scripting failed in 86% of the relevant samples. This is not the kind of problem a newer model quietly removes.
~2×
the rate at which AI-assisted commits leak secrets
Commits written with AI assistance exposed API keys and passwords at roughly twice the rate of human-only commits. AI optimizes for getting things running, which usually means putting the key wherever it works fastest.
CVSS 9.3
severity assigned to missing database permissions in AI-builder apps
CVE-2025-48757 describes insufficient row-level security in generated sites, allowing unauthenticated attackers to read or write arbitrary database tables — rated in the highest CRITICAL band. The vendor has disputed the CVE, on the grounds that protecting application data is the customer's responsibility. In other words: it is officially your responsibility as the person who built it. That is precisely why this page exists.
None of this is an argument against the tools. It means that shipping fast and shipping safely are two different jobs, and the second one is still on us.
What you can ask for, and what it costs
As much as you need, and no more
You don't have to start big. If all you want to know is whether it's safe to ship, the first tier is enough. Prices are honest “from” anchors; the exact quote comes out of a free intro call.
Pre-launch light review
From $210
scoped per project
Tells you whether the app you built with AI (Claude Code, Cursor, Lovable, …) has a hole that must not go live. No coding knowledge required.
- Turnaround
- ~3 business days
Spot review
From $680
scoped per project
Get an accurate picture of how exposed you are right now. Automated scanning plus manual review, delivered as a prioritized findings report (no fix implementation).
- Turnaround
- ~1 week
Standard audit
From $1,900
scoped per project
A full audit that goes into the design. Reviews the authorization model, RLS policies, service_role paths, and tenant boundaries, and delivers a concrete remediation design.
- Turnaround
- ~2–3 weeks
Embedded fix
From $4,800
scoped per project
Don’t stop at detection — close the vertical risks together, from design through implementation and tests. Solo × AI (Claude Code), fast and safe.
- Turnaround
- Scoped (a few weeks+)
I assume you can't read the code. I'll walk you through sharing the repository.
See the full scope and pricingWho's looking at it
Someone who uses the same tools and runs them in production
I'm not commenting from the outside on whether building with AI is risky. I build and operate production products with Claude Code, and I've closed the gaps it leaves on real client work.
A payments platform with zero double-charges in production
I designed and implemented the idempotency that keeps duplicate payment notifications from charging twice, and it has held at zero in production. Everything I write about payments is grounded in this engagement.
A B2B SaaS that won Japan's METI Minister's Award
A B2B subscription platform digitising lumber distribution, including the authentication, authorization and multi-tenant design. The same problems you have, solved at business-system scale.
I ship my own products too
Not only client work — I build and release my own products. I know what it feels like to have something you want to launch, and to be nervous the night before.
Said up front
When you don't need to hire anyone
I don't think everyone needs a paid review. If any of these describe you, the free self-check is enough.
- It's a tool only you use, internally or at home. If it isn't reachable from outside, your exposure is limited.
- There's no login, no other people's data and no payments. A site that just displays information has very little to worry about.
- You're still building and haven't set a launch date. This can wait until launch is in sight.
- The self-check returned zero critical items. In that state, carrying on by yourself is perfectly reasonable.
If you'd rather understand it yourself
I write these up with the jargon translated
For people who want to understand before asking. From “what is RLS” through “how to hand this over to an engineer,” ordered by what can actually hurt you. All free to read.
FAQ
What people ask before getting in touch
Can I ask for help if I can't program?
Yes — that's the assumption this page is built on. I translate the jargon when I explain things, and reports are written for non-engineers. If you don't know how to share your repository, I'll walk you through that too.
Are you going to tell me building it with AI was a mistake?
No. I write production products with Claude Code every day. Building with generative AI is simply fast and cheap, and often the right call. My position is only that shipping fast and shipping safely are different jobs, and the second one is still ours.
I'm nervous about showing anyone my code.
Reasonable. The free self-check never sends your code anywhere — it runs entirely in your browser. For a paid review, sharing only the parts that matter is fine, and we can put an NDA in place first.
What does it cost?
The light pre-launch review starts at $210 and takes about three business days. You get a verdict on whether critical holes exist, a report written for non-engineers, and fix instructions you can paste straight into your AI tool. Deeper design review or implementing the fixes moves you up a tier depending on scope. We settle the scope on a free intro call.
It's already live with users. Is it too late?
It isn't. There's plenty you can still do, and with real users we close things in an order that avoids taking the service down. We start by deciding whether anything needs stopping right now. If money or personal data is moving, acting sooner leaves you more options.
Can you take over my app and keep developing it?
Yes. Handovers are cheaper with preparation, so the usual first step is establishing the current state — what lives where, where the keys are, and whether you can roll back. The review output doubles as the handover document.
Does this work if I used something other than Claude Code?
Yes — Cursor, Lovable, v0, Bolt, Replit, any of them. The gaps are common across tools. Builders that provision a backend for you (Lovable, Bolt, v0) tend to ship with invisible database permission gaps, so I look there especially carefully.
Start by finding out where you actually stand
The free self-check is 20 questions and about five minutes, with no signup and no email field. The result tells you how to fix each item and gives you instructions to paste into your AI tool. Bring me only what's left.
I reply within two business days, and I don't send sales follow-ups.