Other people’s data
Can one customer open another’s orders, profile or files? We test the database access rules — Supabase RLS, Firebase rules — and files in storage.
CVE-2025-48757: 170 OF 1,645 LOVABLE APPS HAD WRONG DATABASE ACCESS RULES SECURITY TESTING
Data exposed? We find the holes.
Apps built with AI often expose other users’ data through database rules or keys in the code. Our cybersecurity specialist finds it before an attacker does. Only your app, with your permission and without harming data.
Vulnerability testing — $349, with bug testing — $499. Deep security testing — $990.VULNERABILITY TESTINGWorking doesn’t mean
Working doesn’t mean
secure.
An app can work perfectly — and still hand other people’s data to anyone who knows where to look. A cybersecurity specialist tries to break into it the way a hacker would.
Keys and admin
Keys and passwords that ended up in the app’s code. Admin panels and APIs that open without login.
ESCAPE · OCTOBER 2025: 400+ EXPOSED SECRETS IN 5,600+ APPS BUILT WITH AIPayments and login
Can paid access be unlocked with a fake webhook? Is the number of login attempts limited, so a password can’t be guessed?
NON-DESTRUCTIVE: ONLY YOUR APP, ONLY WITH YOUR PERMISSION+
Included in the “Bugs + vulnerabilities” package, or order it on its own. This is not a pentest: deep security testing (a pentest) is a separate service at $990.
PricingTWO LEVELSCommon holes
Common holes
or a deep attack.
Vulnerability testing is not a pentest: it is non-destructive checks for the most common holes. Deep security testing is a manual attack following OWASP.
| Vulnerability testing | Deep security testing | |
|---|---|---|
| For whom | Any app with sign-in, a database or payments | Apps with money, personal or health data; when a customer or partner asks for a security report |
| What we do | Database access rules (Supabase, Firebase), keys in the code, admin and API without login, other users’ files, forged payments, password guessing | A manual attack following OWASP (WSTG, ASVS level 1): sign-in and sessions, roles and other users’ data, the API, payment and business logic, files and secrets |
| Scope | The app, all its platforms — one price | One web or mobile app, up to three roles and up to 50 API endpoints |
| Report | Every vulnerability with steps to reproduce, a screenshot and an AI prompt; one retest | A report by risk level with steps to reproduce and recommendations; one retest of fixes within 14 days |
| Timing | Report within 5 business days of the test plan | Report within 10 business days of the agreed testing window |
| Price | $349, with bug testing $499 | $990 per app; each next platform another $990 |
Both only on your app and with your written permission: no denial of service, no mass mailing, no access to real customer data beyond what is needed to prove a finding.
HOW IT WORKSPermission, scope,
Permission, scope,
report.
You confirm the app is yours — our team does the rest.
You send a link and permission
At checkout you confirm you own the app or have the owner’s written permission.
We agree the scope
For vulnerability testing — a test plan within 1 business day. For deep security testing — the scope and the testing window in the project chat.
You get the report
Every vulnerability with steps and a recommendation. One retest of fixes within 14 days.
PRICESThree levels.
Three levels.
Fixed prices.
You see the total before paying. The money-back guarantee applies to Bugs + vulnerabilities.
WITHOUT BUG TESTING
Vulnerability testing
We try to break in, the way a hacker would.
$349/ app
Order — $349 - Database access rules (Supabase, Firebase)
- Keys and passwords in the code
- Admin and API without login
- Other users’ data and files
- Forged payments and password guessing
- All the app’s platforms — one price
- One retest of fixes
FOR APPS WITH PAYMENTS OR PERSONAL DATARECOMMENDED
Bugs + vulnerabilities
Bug testing and vulnerability testing together.
- Everything in Bug testing: up to 25 screens, 5 scenarios, up to three roles
- Everything in Vulnerability testing
- Every bug with a screenshot and an AI prompt
- One retest of the bugs you fixed
No bug found — 100% back
FOLLOWING OWASP
Deep security testing
A pentest: a manual attack on your app.
$990/ 1 app
Order — $990 - Sign-in and sessions: can the password be bypassed or a session taken over
- Roles and other users’ data: up to three roles
- The API — up to 50 endpoints
- Payment and business logic
- File and secret storage
- A report by risk level with recommendations
- One retest of fixes
- Each next platform — another $990
QUESTIONSFrequent
Frequent
questions.
Is it legal?
Yes, if the app is yours or its owner gave written permission — you confirm this at checkout. We test only your app and never touch third-party systems.
How is vulnerability testing different from a pentest?
Vulnerability testing is non-destructive checks for the most common holes in apps built with AI. Deep security testing (a pentest) is a manual attack following OWASP within an agreed scope and window, with a report by risk level.
Will you break my live app?
No: the checks are non-destructive — no denial of service, no mass mailing. For deep security testing we can work on a test environment; we agree it in the chat.
Do you need access to the code?
No. We test from the outside, like a hacker. You add test accounts for the roles in the project’s secure field, not in the chat.
Do you guarantee full security?
No. No testing can guarantee there are no vulnerabilities: we find and describe what we found within the agreed scope.
Does the money-back guarantee apply?
“No bug found — 100% back” applies to Bugs + vulnerabilities. It does not apply to vulnerability testing on its own or to deep security testing.