piperlink Sign inOrder testing
BUG & VULNERABILITY TESTING

Built with AI? Tested by experts.

A QA engineer tests your app for bugs, a cybersecurity specialist for vulnerabilities. You get a test report: every bug with a screenshot and an AI prompt.

Bug testing: $299. No bug found — 100% back.
+ YOUR APP → MANUAL TESTING → YOUR REPORT
acme-portal.lovable.app
You send a link
PIPERLINK / REPORT

Test report

Acme Portal · bugs and vulnerabilities

  • Critical«Pay» twice — two orders
  • HighPaid, still «Awaiting payment»
  • SecurityOther customers’ orders show without login

Each with a screenshot, steps and an AI prompt.

You get the report
LovableBase44BoltReplitv0RorkCursorClaude CodeCodexWindsurf
HOW IT WORKS

From “it works on my screen”
to “let’s release this.”

Before or after launch, an independent team finds the bugs before your customers do.

01

You send a link.

Nothing else to fill in. We write a test plan for your app within 1 business day of payment.

TEST PLAN WITHIN 1 BUSINESS DAY
02

We hunt for bugs.

Every screen and button, 5 main scenarios, all roles. Every bug with a screenshot, steps to reproduce and a ready AI prompt.

REPORT WITHIN 5 BUSINESS DAYS
03

You fix. We retest.

Fix the bugs in Lovable, Cursor or another AI tool with our prompts. We retest the bugs you fixed once, for free, within 14 days.

ONE RETEST OF YOUR FIXES
WHAT WE TEST

Looks good.
But does it hold up?

We go through your app the way your customers will — and find where they get stuck.

01 / BUGS

Can people use it?

Sign-up and login, the main action, payment, e-mails, the account and admin. After updates: did anything old break?

See a sample report ↓
02 / WEB

Web applications

We test your website or web app on a computer (Chrome) and a phone (Safari): sign-up, the account, payment, e-mails and admin.

How we test web apps ↗︎
03 / MOBILE

Mobile applications

We test your iOS or Android app on a real phone: installation, the main actions, permissions, offline behaviour and payment with a test card. We choose the devices, on the latest system versions.

How we test iOS and Android apps ↗︎
VULNERABILITY TESTING

Working doesn’t mean
secure.

An app can work perfectly — and still hand other people’s data to anyone who knows where to look. A cybersecurity specialist tries to break into it the way a hacker would.

01 / DATA

Other people’s data

Can one customer open another’s orders, profile or files? We test the database access rules — Supabase RLS, Firebase rules — and files in storage.

CVE-2025-48757: 170 OF 1,645 LOVABLE APPS HAD WRONG DATABASE ACCESS RULES
02 / ACCESS

Keys and admin

Keys and passwords that ended up in the app’s code. Admin panels and APIs that open without login.

ESCAPE · OCTOBER 2025: 400+ EXPOSED SECRETS IN 5,600+ APPS BUILT WITH AI
03 / PAYMENTS AND LOGIN

Payments and login

Can paid access be unlocked with a fake webhook? Is the number of login attempts limited, so a password can’t be guessed?

NON-DESTRUCTIVE: ONLY YOUR APP, ONLY WITH YOUR PERMISSION
+

Included in the “Bugs + vulnerabilities” package, or order it on its own. This is not a pentest: a full penetration test is a separate service under contract.

Pricing
SAMPLE REPORT

More than a scan.
A clear next move.

The full report: the verdict, what and how we tested, results by scenario, every bug and vulnerability with steps to reproduce, a screenshot and an AI prompt, the retest.

Full sample report Choose a package
PIPERLINK · TEST REPORTFictional example
Acme PortalRelease report · version 1.4
VerdictDo not release until 2 critical and 3 high issues are fixed.
2Critical3High3Medium2Low
ScenarioPassedFailed
Sign-up and login122
Catalogue, cart, payment113
E-mails91
Customer account93
Admin101
B-01Critical

Pressing “Pay” twice creates two orders and charges twice

9 more issues — with steps, screenshots and prompts

Open the full report →
WHO TESTS

People, not a script.
The piperlink team.

A team tests your app: QA engineers who go through it by hand the way your customers will, and cybersecurity specialists. Automated tests and AI are our tools; every bug in the report was found and checked by a person.

01 / QA

QA engineers

They walk every flow by hand on real devices: a desktop browser, an iPhone, an Android phone. Every bug comes with a screenshot and steps to reproduce.

A PERSON WRITES THE REPORT, NOT A GENERATOR
02 / SECURITY

Cybersecurity specialists

They look for ways into other users’ data, keys and the admin panel. Only your app, only with your permission, without harming data.

NON-DESTRUCTIVE CHECKS
03 / CHAT

Your project manager

One contact in the project chat: agrees the test plan, answers questions and keeps the dates. You write — a person from the team answers.

WE ANSWER IN THE CHAT ON BUSINESS DAYS
PRICING

Start with a release.
Take it from there.

Fixed prices. You see the total before you pay — nothing is charged without your decision.

THE WHOLE APP · UP TO 25 SCREENS

Bug testing

The first test of your app.

$299/ 1 platform
Order bug testing — $299
  • The whole app — up to 25 screens or pages
  • 5 main scenarios: sign-up, the main action, payment, e-mails, admin
  • Up to three roles: e.g. customer, manager, admin
  • A real computer and phone
  • Every bug with a screenshot and an AI prompt
  • One retest of the bugs you fixed

No bug found — 100% back

SAVE UP TO $347

Testing subscription

For regular releases.

$746$399/ 4 tests · 30 days
Choose the subscription — $399
  • Bug testing of the whole app now, as in the $299 package
  • 3 more tests of your updates: what’s new, and that nothing old broke
  • A report for each update within 2 business days
  • One outage diagnosis in your live app per month
  • No auto-charge: at the end you decide whether to continue

No bug found — 100% back

Update testing — $149. For an app we have tested before. Order update testing ↗︎

Vulnerability testing — $349. Without bug testing. Order on its own ↗︎

Options. One more platform — +$149. 25 more screens — +$149. Rush report within 1–2 business days — +$99.

QUESTIONS

A few good
questions.

Which apps do you test?

Web and mobile apps built with Lovable, Bolt, Base44, Rork, Replit, Cursor, Claude Code, Codex or other AI tools. Your stack does not matter. For iOS and Android, a link to the App Store, Google Play or TestFlight is enough. Desktop apps are not covered yet.

What will I receive?

A test plan from our team within 1 business day of payment. Then a test report: every bug with priority, environment (device, browser, OS), steps to reproduce, expected and actual result, a screenshot and a ready AI prompt (Lovable, Cursor). It arrives in the project chat as a file that is easy to forward to your developer or team. Questions go in the project chat. After you fix the bugs, we retest them once for free within 14 days.

What counts as a screen?

In a mobile app it is a screen; on a website or in a web app, a page with its own purpose: home, catalogue, product page, cart, account, settings, admin. Pages from one template — 100 products or articles — count as one screen. Pop-ups and states (an error, an empty list) belong to their screen. Up to 25 screens are included; if there are more, add “25 more screens” for $149, or we test the 25 most important ones and list the rest in the test plan.

How do we communicate?

Everything happens in the project chat. We reply Mon–Fri, 10:00–18:00 UTC.

What is vulnerability testing?

Break-in attempts, the way a hacker would: opening other people’s data, getting around the database access rules (Supabase RLS, Firebase rules), finding keys and passwords in the code, reaching the admin panel and API without login, pulling other people’s files from storage, forging payments (webhooks) and guessing passwords by brute force. The attempts are non-destructive and only with your permission. It is not a pentest: a full penetration test is a separate service under contract. Price: $349 on its own, or $499 in the “Bugs + vulnerabilities” package together with bug testing.

Will you fix the code for me?

No. You or your AI tool fix the bugs — every bug comes with a ready prompt. Then we retest the bugs you fixed once, for free, within 14 days of the report. The release decision is yours.

What access will you need?

Only the link to your app. If you cannot get in without a login, you add a test login to an encrypted field after payment. Never share real customer passwords or your main admin account.

Will you sign an NDA?

Yes — on request we sign an NDA before testing starts; write in the project chat. Even without one, everything you share is confidential under the offer: test logins are encrypted and deleted 14 days after the project ends, and we never publish findings.

Do you test with real data and real payments?

Preferably on a staging environment or with test accounts. We check payments with a test card in your payment provider’s test mode (Stripe, WayForPay and others) — no real charges and no mass e-mails. If you only have the live app, the test plan sets what we may do so your customers are not affected.

What language is the report in?

The language you ordered in: English or Ukrainian.

Can I get an invoice?

Yes. Right after payment you receive an order confirmation by e-mail; an invoice and a statement of services are sent on request — write your company details in the project chat.

What counts as one scenario?

One complete user action from start to finish: for example, sign-up, an order, or paying and getting access. We test 5 main ones in depth: sign-up and login, the main action, payment with a test card, e-mails, the account and admin. We go through the other screens too — up to 25; if there are more, we take the 25 most important ones and list the rest in the test plan.

How does the subscription work?

$399 per 30 days: bug testing now (as in the $299 package — up to 25 screens or pages) + 3 tests of your updates (if we have tested your app before, 4 update tests). No auto-charge for the first 30 days. 5 days before the end you choose in the project chat: another 30 days or a monthly payment that you can cancel any time with one button. Unused tests do not carry over.

What happens if my app goes down?

On the subscription, once a month we diagnose an outage in your live app: the symptoms, available logs, the likely cause and a fix prompt. We start within 4 working hours (Mon–Fri, 10:00–18:00 UTC). There is no 24/7 on-call, no code repair and no guaranteed time to fix.

Do you guarantee there are no bugs left?

No. We give you evidence within the test plan. Testing does not cover every possible device and scenario, is not a security certificate and does not guarantee App Store or Google Play approval.

What if you find no bug?

You get 100% back to your card. A bug is a reproducible defect we show on a screenshot with steps to reproduce that gets in the way of your customer or you. Remarks about copy and design do not count. Write in the project chat within 14 days of the report.

How do I order and pay?

Choose a package, paste your app link and sign in with Google or with the code we e-mail you. Pay by card on the secure WayForPay page at the fixed price. After payment your project chat with our team opens — we write the test plan. Nothing is charged without your decision.

Keep the vibe.
Lose the bugs.