Your app works.
Who else
can see it.
You built something with AI help and it runs. That tells you nothing about who can read your customer list. Send me the address and I will tell you what a stranger can get at, in plain English, with the evidence attached.
I tested it on apps whose problems I knew.
Ten small apps. Eight with specific problems planted in them. Two deliberately clean, including one stacked with things that look alarming and are all fine. Then I scored it against the answers.
That is the whole of my evidence. No customer results yet, because you would be among the first. If that makes you want to wait, wait.
Three questions, nothing else.
Not code style. Not test coverage. The three things that actually cost you something.
Can a stranger read or change data you thought was private?
Admin pages with nothing in front of them. Database rules that are wider than you meant. Tables where the lock was never switched on at all.
Can a stranger spend your money?
Keys sitting in the page source where anyone can lift them. AI endpoints with no limit, where one script overnight becomes a four figure bill.
Will it break when real people arrive?
Forms that fail silently and lose signups. Pages that get slower every week. The things that quietly cost you customers.
- You built it with AI help and you are not an engineer
- It stores anything at all about your users
- You are about to put it in front of real people
- You would rather know now than hear it from a customer
- You want a full code review or a security certificate
- You have an engineer who already owns this
- You want reassurance rather than findings
- There is nothing deployed and no repository yet
Address in. Report back.
Send the address
Your live URL, or read access to the repository. No call, no deck, no form with eleven fields.
I run the check and read the result
It maps every way in, works out what each one touches, and confirms what it can. Then I read it before it goes anywhere near you.
You get the report
Verdict first. Each problem as one short paragraph with the fix and how long it takes. Technical detail folded away at the bottom for whoever does the fixing.
What this does not tell you.
A check that overstates what it covers is worse than no check, because you stop looking. So here is the boundary.
- It reads your code. It cannot yet start your app and show you the leak happening.
- It cannot see settings that live in your hosting account rather than your code.
- It cannot see rules you added by clicking around in a dashboard.
- A clean result means nothing was found in what was checked. It never means you are secure.
Anything it could not confirm is listed as exactly that, with the one thing you can do to settle it. You should never have to take my word for a finding.
Find out who can read it.
Free while I am still learning what makes the report useful. In exchange I will ask you two questions afterwards about whether it was any good.