Security Review for AI-Built and Vibe-Coded Apps

This package reviews an app built with Lovable, Bolt, Replit, v0 or Cursor for the security gaps AI builders leave behind: secret keys in the browser, database tables anyone can read, and pages or API routes that never check who is asking. You get a plain-language report, fixes you can paste into your AI builder or database, and a retest.

Common gaps in generated apps

• Supabase tables without row-level security, so the public anon key reads or edits every row.
• A service role key, OpenAI key or Stripe secret key bundled into the frontend JavaScript or pushed to a public repository.
• Firebase rules left open from the prototype stage.
• API routes and server functions that take a user ID from the request instead of the session.
• Admin screens hidden only by the menu, public storage buckets, and Stripe webhooks that skip the signature check.

I check access with two test accounts, trying to read and change each other's data. Premium also covers edge functions, scheduled jobs and any AI feature in the app, testing whether a crafted message can make it leak data or run up your model bill.

Fixes you can apply yourself

Each finding comes with the reason it matters and the fix in two forms: the exact change, such as a row-level security policy in SQL, and a prompt you can give your AI builder. From Business up, I write the policies for your tables, so the most common gap is closed by pasting one script.

Whose permission and what comes next

You confirm in writing that you own the app and the Supabase, Firebase or Vercel project behind it; I test your project under those platforms' rules, not the platforms themselves. When the review shows the app needs more than security fixes, such as rebuilt features or a cleaner codebase, that is vibe-coded app rescue work.