Your QA team. Without hiring.
A QA engineer tests every release you ship, a cybersecurity specialist tests for vulnerabilities. A report with a verdict by the next business day. A fixed monthly price, cancel any time.
From $990 a month. Want to try first? Bug testing — $299, credited to your subscription.Release 1.4: report
Verdict: not yet — fix 2 bugs first
- CriticalPromo code applies twice — 20% off
- HighCart is empty after sign-in
- SecurityPromo codes can be guessed with no limit
Each with a screenshot, steps and an AI prompt. A security questionnaire letter every month.
From “it works on my screen”
to “let’s release this.”
An independent team tests every release — before your customers see it.
You send a link.
The first month is bug and vulnerability testing of the whole app. It gives you a regression suite that belongs to you.
ONE LINK. THE REGRESSION SUITE IS YOURS.You write: “the release is ready”.
A regression of the main scenarios and what is new — a report with a verdict by the next business day. Every bug with a screenshot, steps and an AI prompt.
REPORT BY THE NEXT BUSINESS DAYYou fix. We retest.
A retest of the fixed bugs after every report. Every month — vulnerability testing and a letter for your clients’ security questionnaires.
A RETEST AFTER EVERY REPORTLooks good.
But does it hold up?
We go through your app the way your customers will — and find where they get stuck.
Can people use it?
Sign-up and login, the main action, payment, e-mails, the account and admin. After updates: did anything old break?
See a sample report ↓Web applications
We test your website or web app on a computer (Chrome) and a phone (Safari): sign-up, the account, payment, e-mails and admin.
How we test web apps ↗︎Mobile applications
We test your iOS or Android app on a real phone: installation, the main actions, permissions, offline behaviour and payment with a test card. We choose the devices, on the latest system versions.
How we test iOS and Android apps ↗︎Working doesn’t mean
secure.
An app can work perfectly — and still hand other people’s data to anyone who knows where to look. A cybersecurity specialist tries to break into it the way a hacker would.
Other people’s data
Can one customer open another’s orders, profile or files? We test the database access rules — Supabase RLS, Firebase rules — and files in storage.
CVE-2025-48757: 170 OF 1,645 LOVABLE APPS HAD WRONG DATABASE ACCESS RULESKeys and admin
Keys and passwords that ended up in the app’s code. Admin panels and APIs that open without login.
ESCAPE · OCTOBER 2025: 400+ EXPOSED SECRETS IN 5,600+ APPS BUILT WITH AIPayments and login
Can paid access be unlocked with a fake webhook? Is the number of login attempts limited, so a password can’t be guessed?
NON-DESTRUCTIVE: ONLY YOUR APP, ONLY WITH YOUR PERMISSIONIncluded in every subscription tier and in the “Bugs + vulnerabilities” package, or order it on its own. This is not a pentest: deep security testing (a pentest) is a separate service at $990.
PricingMore than a scan.
A clear next move.
The full report: the verdict, what and how we tested, results by scenario, every bug and vulnerability with steps to reproduce, a screenshot and an AI prompt, the retest.
Choose a package| Scenario | Passed | Failed |
|---|---|---|
| Sign-up and login | 12 | 2 |
| Catalogue, cart, payment | 11 | 3 |
| E-mails | 9 | 1 |
| Customer account | 9 | 3 |
| Admin | 10 | 1 |
Pressing “Pay” twice creates two orders and charges twice
- Open the payment page /checkout.
- Enter the test card 4242 4242 4242 4242.
- Quickly press “Pay” twice.
$24.00 · Succeeded · 14:02:11
$24.00 · Succeeded · 14:02:11
On the payment page, disable the “Pay” button and show a spinner from the first click until the request finishes. In the create-payment function, make the request idempotent: generate one key per cart and return the existing payment when the same key arrives again. Add a test: two clicks within 300 ms create exactly one order and one charge.
9 more issues — with steps, screenshots and prompts
Open the full report →You build with AI.
We test like professionals.
We work with AI too — and pair it with the experience of QA engineers and cybersecurity specialists. We go through your app by hand on real devices, like your customers, and look for holes like an attacker. Every bug comes back as a ready prompt for your AI tool.
QA engineers
They walk every flow by hand on real devices: a desktop browser, an iPhone, an Android phone. Every bug comes with a screenshot and steps to reproduce.
EVERY BUG WITH A PROMPT FOR YOUR AICybersecurity specialists
They look for ways into other users’ data, keys and the admin panel. Only your app, only with your permission, without harming data.
NON-DESTRUCTIVE CHECKSYour project manager
One contact in the project chat: agrees the test plan, answers questions and keeps the dates. You write — a person from the team answers.
WE ANSWER IN THE CHAT ON BUSINESS DAYSA fixed monthly price.
A whole QA team.
Paid monthly by tier. Cancel any time — one button in the project chat.
Start
A team of 1–5 developers.
- 4 release tests a month, 1 platform
- A report with a verdict by the next business day
- Vulnerability testing every month
- A letter for your clients’ security questionnaires
- Chat answers within 1 business day
- Unused tests carry over to the next month
Deadline guarantee: a late report does not count
Growth
A team of 3–10 developers.
- 10 release tests a month, up to 2 platforms
- A report with a verdict by the next business day
- Vulnerabilities every month, deeper each quarter
- Daily automated tests of the 5 main scenarios
- Chat answers within 4 business hours
- A security letter; the regression suite is yours
Deadline guarantee: a late report does not count
Team
A team of 8–20 developers.
- 20 release tests a month, up to 3 platforms
- Release by 12:00 — report the same day
- Vulnerabilities every week, a deep security test each quarter
- Daily automated tests of 10 scenarios
- Chat answers within 2 business hours
- A dedicated QA engineer and cybersecurity specialist
Deadline guarantee: a late report does not count
For comparison: an in-house QA engineer in the US earns about $8,700 a month on average — salary alone, before taxes, equipment, time off and security work (BLS median, May 2025). Source ↗︎
Want to try first? Bug testing — $299, Bugs + vulnerabilities — $499. Subscribe within 30 days and the price is credited to your first month. Order bug testing ↗︎
Update testing — $149. For an app we have tested before. Order update testing ↗︎
Vulnerability testing — $349. Without bug testing. Order on its own ↗︎
Options for one-off tests. One more platform — +$149. 25 more screens — +$149. Rush report within 2 business days — +$99.
More services. Accessibility testing, deep security testing, production setup, app care and daily automated tests. All services ↗︎
A few good
questions.
Why not hire a QA engineer?
The median QA engineer salary in the US is $104k a year (BLS, 2025), about $150k with taxes and benefits — and you still have to find one. The subscription is from $990 a month: it starts next week, comes with a QA engineer and a cybersecurity specialist at once, and you can cancel any time. The test cases and the regression suite stay yours.
How does the subscription work?
Choose a tier: Start — $990 a month (4 release tests, 1 platform), Growth — $2,490 (10, up to 2 platforms), Team — $4,990 (20, up to 3 platforms). The first month is bug and vulnerability testing of the whole app and half the tier’s tests, then the full norm every month. When a release is ready, you write in the project chat and get a report with a verdict by the next business day. Vulnerability testing — every month. Paid monthly from the first month, cancel any time with one button; unused tests carry over to the next month.
What is a release test?
A regression of up to 10 main scenarios and what is new or changed in the release — up to 5 screens or one feature — on one platform. A bigger release takes another test for each further 5 screens or feature; the same release on two platforms takes two tests. After every report, a retest of the bugs you fixed.
What if a report is late?
The deadline guarantee applies: a test whose report is late does not count against your month. The deadline runs from your request in the chat, once the build and access are there; business days are Mon–Fri, 9:00–19:00 Kyiv time.
Can I try it first?
Yes. Bug testing — $299, or Bugs + vulnerabilities — $499. Subscribe within 30 days and we credit the package price to your first month; the package becomes its first test.
Which apps do you test?
Web and mobile apps built with Lovable, Bolt, Base44, Rork, Replit, Cursor, Claude Code, Codex or other AI tools. Your stack does not matter. For iOS and Android, a link to the App Store, Google Play or TestFlight is enough. Desktop apps are not covered yet.
What will I receive?
For every release — a report with a ship-or-not verdict: every bug with priority, environment (device, browser, OS), steps to reproduce, expected and actual result, a screenshot and a ready AI prompt. It arrives in the project chat as a file that is easy to forward to your developer or team. Every month — vulnerability testing and a letter for your clients’ security questionnaires. For one-off bug testing — a test plan within 1 business day of payment, a report within 5 business days of it (a rush one in 2) and one free retest within 14 days.
What counts as a screen?
In a mobile app it is a screen; on a website or in a web app, a page with its own purpose: home, catalogue, product page, cart, account, settings, admin. Pages from one template — 100 products or articles — count as one screen. Pop-ups and states (an error, an empty list) belong to their screen. Up to 25 screens are included; if there are more, add “25 more screens” for $149, or we test the 25 most important ones and list the rest in the test plan.
How do we communicate?
In writing, in the project chat — no calls. On the subscription we answer by tier: within 1 business day, 4 or 2 business hours (Mon–Fri, 9:00–19:00 Kyiv time).
What is vulnerability testing?
Break-in attempts, the way a hacker would: opening other people’s data, getting around the database access rules (Supabase RLS, Firebase rules), finding keys and passwords in the code, reaching the admin panel and API without login, pulling other people’s files from storage, forging payments (webhooks) and guessing passwords by brute force. The attempts are non-destructive and only with your permission. It is not a pentest: deep security testing (a pentest) is a separate service at $990. Price: $349 on its own, $499 in the “Bugs + vulnerabilities” package; included in every subscription tier.
Will you fix the code for me?
Yes, if you want. After the report you can order fixing of its bugs right in the chat: $49, $99 or $149 for up to 20, 50 or 100 bugs; we fix them with AI (we need access to the code) and check every fix with a retest. Or you fix them yourself or with your AI tool — every bug comes with a ready prompt — and we retest the bugs you fixed once, for free, within 14 days of the report. The release decision is yours.
What access will you need?
Only the link to your app. If you cannot get in without a login, you add a test login to an encrypted field after payment. Never share real customer passwords or your main admin account.
Will you sign an NDA?
Yes — on request we sign an NDA before testing starts; write in the project chat. Even without one, everything you share is confidential under the offer: test logins are encrypted and deleted 14 days after the project ends, and we never publish findings.
Do you test with real data and real payments?
Preferably on a staging environment or with test accounts. We check payments with a test card in your payment provider’s test mode (Stripe, WayForPay and others) — no real charges and no mass e-mails. If you only have the live app, the test plan sets what we may do so your customers are not affected.
What language is the report in?
The language you ordered in: English or Ukrainian.
Can I get an invoice?
Yes. Right after payment you receive an order confirmation by e-mail; an invoice and a statement of services are sent on request — write your company details in the project chat.
What counts as one scenario?
One complete user action from start to finish: for example, sign-up, an order, or paying and getting access. We test 5 main ones in depth: sign-up and login, the main action, payment with a test card, e-mails, the account and admin. In payment we also check actions at the same time: a double click on “Pay”, two tabs, paying again and a repeated notice from the payment provider — this is where apps most often create two orders or charge twice. We go through the other screens too — up to 25; if there are more, we take the 25 most important ones and list the rest in the test plan.
What happens if my app goes down?
On the subscription, once a month we diagnose an outage in your live app: the symptoms, available logs, the likely cause and a fix prompt. We start within 4 working hours (Mon–Fri, 9:00–19:00 Kyiv time). There is no 24/7 on-call, no code repair and no guaranteed time to fix. Watching a live app day to day is App care ($290 per 30 days) on your own hosting.
Do you guarantee there are no bugs left?
No. We give you evidence within the test plan. Testing does not cover every possible device and scenario, is not a security certificate and does not guarantee App Store or Google Play approval.
What if you find no bug?
For one-off bug testing, Bugs + vulnerabilities, Bug testing · 10 screens and update testing — you get 100% back to your card. A bug is a reproducible defect we show on a screenshot with steps to reproduce that gets in the way of your customer or you. Remarks about copy and design do not count. Write in the project chat within 14 days of the report. A subscription has the deadline guarantee instead.
How do I order and pay?
Choose a tier or a package, paste your app link and sign in with Google or with the code we e-mail you. Pay by card on the secure WayForPay page at the fixed price; a subscription is charged monthly with your separate consent. After payment your project chat with our team opens — we write the test plan. Nothing is charged without your decision.