For Lovable · Bolt · Cursor · Replit · v0 apps
Send your GitHub repo or live URL. Within 24 hours you get a plain-English fix list: exposed keys, Supabase RLS holes, auth gaps, vulnerable packages, bugs and deploy blockers — each with copy-paste fix steps.
Human audits cost $300–$2,000. Ours is $49, flat, and done in under a day.
API keys in code or git history, committed .env files, secrets leaked through VITE_/NEXT_PUBLIC_ variables.
Tables without Row Level Security, USING (true) policies, service-role key in the frontend, open Firebase rules.
API routes anyone can call, SQL built from strings, unsanitised HTML (XSS), eval, wide-open CORS.
Known CVEs in your npm / Python dependencies, which are direct, and the exact upgrade.
Static analysis across hundreds of rules, oversized images, debug logs leaking user data.
HTTPS & security headers, lockfile, build script, Node version, undocumented env vars.
Deep review of a public Lovable + Supabase clinic booking app (anonymised as “Vitality Hub”). Not a dump of scanner output — every finding has file/line evidence, an attack story, a patch, and a paste-prompt for Lovable/Cursor.
RLS policy using (true) on the users table. A stranger with the anon key can download names, emails and phones.
create_user_profile is SECURITY DEFINER, granted to anon, and overwrites role from caller input.
Committed in a bootstrap script, with the same email hard-coded as “magic admin” in the DB trigger and React.
LAUNCH PRICE · first 50 audits
$49
$99
COMPARE
$300–2k
typical human audit
Both, on purpose. Industry scanners (secrets, Semgrep, dependency audits) are the input — not the report. An AI code-reasoning pass then reads your auth flows, Supabase RLS, and API routes to verify findings, write attack scenarios, patches, and Lovable/Cursor paste-prompts. For the first ~20 orders a human reviews every Critical/High before delivery. That's how a $49 report stays worth more than free npm audit output.
Yes. Add our read-only GitHub account as a collaborator after ordering, and remove it after delivery. Code is scanned in a temporary workspace and deleted.
We'll check what's visible from outside: HTTPS, security headers, keys leaked in the page bundle. A repo gets you a much deeper report.
No. It's automated guidance, not a guarantee, and not a penetration test. It catches the common, costly mistakes; it can miss things and occasionally flag false positives.
Full refund within 7 days, no questions. Automatic refund if we miss 24 hours.
JavaScript/TypeScript (React, Vite, Next.js, Node, Supabase, Firebase) and Python. These cover most Lovable, Bolt, Cursor and Replit apps.
The best new AI & vibe-coding tools, plus one security mistake to avoid, every week.
The digest isn't live yet, so your email was not saved. Follow @snakeace on X for the launch.
Coming soon. Signups aren't stored yet.