Security audit
A person reviews your app properly, including everything a scan cannot reach, and writes up each issue in plain English with the steps to fix it, most important first.
What the audit covers
Everything a scan cannot reach from the outside, looked at by a person who knows how apps built with AI tools tend to go wrong.
- Sign-up, login and password reset
- Database rules in Supabase or Firebase
- API routes and who can call them
- Secrets, keys and environment settings
- Whether the vulnerable libraries in your app can actually be exploited
- Everything in the verified scan, checked by hand
- A written report and a call to walk through it
Who it is for
-
You built your app with an AI coding tool
Lovable, Bolt, Replit, v0, Cursor, Claude Code or something similar, and you would like a person to check what it wrote.
-
Real people are about to use it
You are about to launch, or people already sign up, pay or store their details in it.
-
You want a clear answer, not a longer list
What matters most, what can wait, and exactly how to fix each one.
What happens after you pay
-
Step 1: Pay securely with Stripe, to come
Stripe takes the payment and emails your receipt and a VAT invoice. You can add a business VAT number at checkout.
-
Step 2: Tell us about your app, to come
A short form, about five minutes: what you built it with, where it runs and what worries you most.
-
Step 3: Agree access, without passwords, to come
We never ask for passwords or keys. We agree a safe way in with you, and you can remove it as soon as we are done.
-
Step 4: Your report and a call, to come
Delivered by the date we agree with you once we have access. Every issue in plain English, most important first, then a call to walk you through it.
Caution
We never need your passwords or keys
Not in the form, not by email. We agree access with you in the tool itself, and you can remove it as soon as the audit is done. If something needs a login, we ask you for a separate test account.
Ways we can look at your app, whichever suit you:
- Invite us to the code repository
- A staging or preview address we can test
- A read-only database role
- A screen share with you
Questions before you book
Can I get a refund?
If we cannot do your audit, we refund you in full. For any other question about a refund, email us with your order reference and we will look at it with you.
Do you need my passwords or keys?
No, never. After you pay, you choose how we can look at your app: an invite to your code repository, a staging address, a read-only database role or a screen share. If something needs a login, we ask for a separate test account.
Do I need to verify my site first?
No. Verifying ownership is free and runs deeper automatic checks, but the audit does not depend on it. The audit is for apps you own or are authorised to have tested.
Will I get a VAT invoice?
Yes. The £395 includes VAT. Stripe emails your receipt and a VAT invoice once the payment is confirmed, and you can add a business VAT number at checkout.
How does the credit work?
The full £395 comes off any fix work you book with us after the audit. Your dashboard shows the credit you have left.
What if you find nothing serious?
You still get the written report and the call, with what we checked and how. It is not a guarantee, but you will know where you stand.