Built it with Lovable? Let's make sure it's safe to launch.
Lovable builds whole apps at startup speed. The Supabase wiring isn't always as careful as your customers will need. We audit the auth, the row-level security, and the public surfaces, before someone scrapes them all.
What we look for first
- RLS policies that effectively let anyone read everything
- Service-role keys checked into the client bundle
- Email/password flows that don't verify emails
- Edge functions that trust the request body
Illustrative examples. Yours might be cleaner. Or worse.
The Lovable mistakes we look for.
Four issues we check in every Lovable-built app, each with the change to make. If any of these sound familiar, you already know why this exists.
RLS that lets anyone in
Row-level security is Supabase's frontline defence. A policy that looks right can still let any signed-in user read every row.
Suggested change: Scope each policy to the rows that user owns.
Service-role keys in the browser
Anything the browser bundle can read, every visitor can read, and a service-role key skips every policy.
Suggested change: Use the anon key in the browser and the service role only on the server.
Auth flows missing email verification
Quick-start auth can skip email verification, which lets anyone sign up with an address they don't own.
Suggested change: Turn on email confirmation before an account can act.
Edge functions that trust input
Supabase edge functions run server-side, but they can be wired as if the body shape is guaranteed.
Suggested change: Validate the body before the function touches data.
How a review works.
Try the free key-leak scan first if you like. When you’re ready for the full review, it goes like this.
You share your code.
Pay once, then send a GitHub link, a public repository URL, or a ZIP of your project.
Day 0
We review it.
We run AI-assisted security checks on your source, review the results by hand, and record what was and was not covered.
Within 5 working days
You fix what matters.
You get a prioritised report in plain English. On request, we send the fixes as a draft pull request or patch. You review, test and merge.
When you’re ready
One price for one project.
Pay once for a review of a single repository. If your stack is bigger than that, we scope it with you first.
Launch scan
PilotOne app, one repo, reviewed by a person.
- High-risk issues that get apps exploited at launch
- API keys, dependencies, config and AI-prompt checks
- Fixes as a draft pull request or patch, on request
- Reviewed by a person, delivered within 5 working days
- Full refund if we cannot deliver a usable report
- A shareable report for investors, teammates or yourself
Scope: one web app or API in a single repository (typical MVP size). Stacks: Node, TypeScript, React, Next.js, Python and most modern frameworks.
$299
One-off, per project. No subscription.
Start with a free lightweight preview, then buy a one-off review of one project. AI-assisted checks are reviewed by a person, and you get a prioritised report in plain English within 5 working days. Fixes can be sent as a draft pull request or patch on request. Review and test any change before you use it.
Payment is handled by Polar.
Deep dive
Custom, scoped together
For several codebases, real infrastructure or a growing team. We review services, environments, cloud, networking and CI/CD, and send a fixed proposal before any work starts.
Talk to usSide by side
| Feature | Launch scan | Deep dive |
|---|---|---|
| Repositories | One | Several |
| Turnaround | Within 5 working days | 1 to 2 weeks |
| Plain-English report | Included | Included |
| Corrected ZIP or draft pull request | Included | Included |
| Cloud and CI/CD review | Not included | Included |
| Optional follow-up reviews | Not included | Included |
| Founder Q&A call | Not included | Included |
Ship it reviewed.
Book the review now, or leave your email and a person will reply within one working day. No commitment and no jargon.