Keys and secrets in the code
Database, payment or AI keys that ended up in the page code and show in the browser.
NOT YOUR PASSWORDS EXPRESS SECURITY AUDIT
Keys exposed? We check outside.
Apps built with AI often expose keys and other people’s data to anyone on the internet. A cybersecurity specialist checks your app from outside — no passwords or access, breaking nothing — and within 2 business days shows what is visible, with steps and fix prompts.
Express security audit — $149 per app. With “Bug testing · 10 screens” — +$99. Free first? App review — $0.WHAT WE CHECKWhat anyone
What anyone
on the internet sees.
No passwords or access, non-destructive: your app as a stranger sees it.
Database rules for an anonymous user
Whether Supabase or Firebase hand out other people’s records and files without sign-in.
SUPABASE · FIREBASEAdmin and API without sign-in
Whether the admin and API requests open for someone who is not signed in.
NON-DESTRUCTIVEService pages and files
Exposed service addresses, backups, configuration files.
WHAT WAS LEFT OUTOutdated components
Libraries with known vulnerabilities, visible from outside.
KNOWN VULNERABILITIESHeaders, SSL and the report
Security headers and SSL. Every finding with its risk level, steps to check and an AI prompt.
REPORT WITHIN 2 BUSINESS DAYSCOMPARISONFrom a review
From a review
to a pentest.
Four steps of security — pick the one you need now.
| How | What you get | Price | |
|---|---|---|---|
| Free app review | From outside, no access | How many risks are visible, by level, and the most important one in full | $0 |
| Express security audit | From outside, no access | The full list of findings with places, steps, prompts and a retest | $149 |
| Vulnerability testing | From inside, with test accounts | Whether one user can reach other users’ data, keys and the admin | $349 |
| Pentest | By hand, to OWASP, with written permission | A report by risk level and a letter for security questionnaires and the auditor | $990 / platform |
The express audit is not a pentest and not testing with test accounts: it shows what is visible from outside. Vulnerability testing and pentest ↗︎
HOW IT WORKSThree steps
Three steps
to the report.
Just a link — no passwords or access.
You send a link
The app’s address — that is all. We install and change nothing.
We check from outside
Non-destructive, like a stranger in a browser. The report within 2 business days of payment.
You fix — we retest
With the prompts in your AI tool. One retest of what you fixed within 14 days of the report.
PRICEA fixed price.
A fixed price.
No surprises.
You see the total before paying.
FROM OUTSIDE · NO ACCESS
Express security audit
What anyone on the internet sees: keys, other people’s data, an open admin.
$149/ app
Order — $149 What’s included
- Keys and secrets in the page code
- Supabase and Firebase rules for an anonymous user
- Admin and API without sign-in
- Service pages and files
- Outdated components, security headers and SSL
- Every finding with its risk level, steps and an AI prompt
- One retest of what you fixed
With bug testing. With “Bug testing · 10 screens” the audit is +$99 instead of $149: bugs and security at once. Learn more ↗︎
Found vulnerabilities? We fix up to 5 findings for $490 — in your repository, with a retest. Or with the report’s prompts — yourself.
Not included. Passwords and test accounts, attacks that could break something, and a certificate. Deeper — vulnerability testing ($349) or a pentest ($990).
QUESTIONSFrequent
Frequent
questions.
Do you need passwords or access to the code?
No. Just a link: we check what anyone on the internet sees. If the app does not open without sign-in, the audit covers only its open part.
Will you break anything?
No. The check is non-destructive: we change no data, put no load on the server and send no e-mails to your users.
My app is on Lovable, Bolt or Base44 with Supabase — does it fit?
Yes — these are the apps where keys and open database rules show most often. The same for Firebase.
How is the audit different from the free review?
The review counts the risks and shows the most important one; the audit gives the full list: every finding with its place, steps to check, a fix prompt and a retest.
Is it a pentest?
No. A pentest is a manual attack with your written permission, from inside, with a report for the auditor ($990). The audit shows what is visible from outside — and often finds the most dangerous things: exposed keys and data.
How long does it take?
The report within 2 business days of payment, then one retest of what you fixed within 14 days.