A security audit for your vibe-coded app, before real users' data goes in

A security audit for a vibe-coded app checks what a demo never shows: keys in the app’s code, who can see and change each record, logins, and whether the server checks every request. I go through your Lovable, Replit or Bolt app and send you a written list of what’s exposed, in order of risk, and what fixing it involves. Do it before real users’ data goes in.

The problem

• The app works and the demo went well, so it looks finished.
• You can’t see what’s exposed. The problems sit behind the screens.
• Real customers are about to sign up, enter their data, or pay.
• A data leak can’t be undone.

Why AI-built apps are often exposed

AI app builders build what you can see first. Many connect the app straight to the database, such as Supabase, with the database key inside the app. Then the only thing keeping each person’s data separate is the database’s rules, and those have to be right everywhere. One missing rule can let one customer see another’s data.

What I check

• Keys in the app’s code. Any key that can reach your data, or another service such as email, SMS or payments, belongs on the server.
• Who can see, change and delete each record. One user must not be able to reach another user’s data.
• Logins and password resets. Who can sign up, and what each person is allowed to do.
• Every request to the server checks who is calling. Nothing can be called without the right login.
• Prices, limits and roles are enforced on the server, not in the browser, where the person using it can change them.
• Admin pages, and who can reach them.

What you get

A written list of what’s exposed, in order of risk, and what fixing each item involves. Some items are quick fixes. When the app talks straight to the database, the fix is bigger: your own server in between, with the keys and the rules moved onto it. That’s usually a rebuild, with your prototype as the specification. See security review of an AI-built Supabase app.

How we start

1. You send me a link to the app and access to its code, and tell me who will use it and what data it holds.
2. I go through it and send you the written list.
3. We go through the list on a call and agree what to fix first.

FAQ

When should I get one? Before real users’ data goes in, and before you take payments. Fixing it after a leak doesn’t undo the leak.

Do you need my code? Yes, for a full audit. A few problems show from the app in a browser, but most are in the code and the database setup.

Do I have to stop using Lovable, Replit or Bolt? Not while it’s still a prototype. Once real users rely on it, I usually rebuild it properly. See why your AI-built app keeps breaking.

Can you fix what you find? Yes, all of it. Bringing a vibe-coded app up to the standard of a secure, production-grade app takes a professional with a deep understanding of how those apps are built. I fix everything on the list and make sure the app meets that standard.