A QA engineer goes through your app the way your first customer will: sign-up, the main action, payment. A report: every bug with a screenshot and a ready prompt for Lovable, Cursor or Claude Code.
We test your iOS or Android app on a real phone: installation, the main actions, permissions, offline behaviour and payment with a test card. We choose the devices, on the latest system versions.
An app can work perfectly — and still hand other people’s data to anyone who knows where to look. A cybersecurity specialist tries to break into it the way a hacker would.
01 / DATA
Other users’ data
Can one user open another’s orders, profile or files. We check the database access rules — Supabase RLS, Firebase rules.
CVE-2025-48757: 170 OF 1,645 LOVABLE APPS HAD FLAWED DATABASE ACCESS RULES02 / KEYS
Keys in the code
Keys and passwords for the database, payments or AI that ended up in the app’s code, visible to anyone in a browser.
ESCAPE · OCTOBER 2025: 400+ EXPOSED SECRETS IN 5,600+ APPS BUILT WITH AI03 / ACCESS
Admin and API without sign-in
Do the admin panel and API requests open without signing in, or with someone else’s account.
NON-DESTRUCTIVE: ONLY YOUR APP, ONLY WITH YOUR PERMISSION
+
An option of bug testing · 10 screens — +$100. Fuller vulnerability testing (also forged payments and password guessing) — $349 on its own. It is not a pentest.
The full report: the verdict, what and how we tested, results by scenario, every bug and vulnerability with steps to reproduce, a screenshot and an AI prompt, the retest.
Pressing “Pay” twice creates two orders and charges twice
Open the payment page /checkout.
Enter the test card 4242 4242 4242 4242.
Quickly press “Pay” twice.
Stripe · Payments (test mode)
$24.00 · Succeeded · 14:02:11
$24.00 · Succeeded · 14:02:11
AI prompt
On the payment page, disable the “Pay” button and show a spinner from the first click until the request finishes. In the create-payment function, make the request idempotent: generate one key per cart and return the existing payment when the same key arrives again. Add a test: two clicks within 300 ms create exactly one order and one charge.
9 more issues — with steps, screenshots and prompts
Open the full report →
WHO TESTS
You build with AI. We test like professionals.
We work with AI too — and pair it with the experience of QA engineers and cybersecurity specialists. We go through your app by hand on real devices, like your customers, and look for holes like an attacker. Every bug comes back as a ready prompt for your AI tool.
01 / QA
QA engineers
They walk every flow by hand on real devices: a desktop browser, an iPhone, an Android phone. Every bug comes with a screenshot and steps to reproduce.
EVERY BUG WITH A PROMPT FOR YOUR AI02 / SECURITY
Cybersecurity specialists
They look for ways into other users’ data, keys and the admin panel. Only your app, only with your permission, without harming data.
NON-DESTRUCTIVE CHECKS03 / CHAT
Your project manager
One contact in the project chat: agrees the test plan, answers questions and keeps the dates. You write — a person from the team answers.
WE ANSWER IN THE CHAT ON BUSINESS DAYS
PRICE
A fixed price. No surprises.
You see the total before paying.
10 SCREENS · 3 SCENARIOS
Bug testing · 10 screens
For an app built with AI — before your first customers or with them.
Web and mobile apps built with Lovable, Bolt, Base44, Replit, v0, Cursor, Claude Code or Codex — and any others. For iOS and Android a link to the App Store, Google Play or TestFlight is enough.
What counts as a screen?
An app screen or a site page with its own purpose. Pages from one template count as one screen. If there are more than 10, we test the 10 most important ones and list the rest in the test plan.
How is it different from the $299 bug testing?
For $299 — up to 25 screens, 5 scenarios (also e-mails, the account and admin) and up to three roles. For $149 — 10 screens, 3 scenarios and one role: for a first look at your app and for small projects.
What does the $100 vulnerability testing cover?
Whether other users’ data can be seen (database access rules — Supabase RLS, Firebase rules), keys and passwords in the code, admin and API without sign-in. Non-destructive and only with your permission. Fuller vulnerability testing is $349 on its own or $499 with bug testing.
Do you fix the bugs?
Every bug comes with a ready prompt for your AI tool. If you want, after the report you can order fixes right in the chat: $49 for a pack of up to 20 bugs.
How long does it take?
The test plan within 1 business day of payment, the report within 5 business days of the test plan, then one retest of the bugs you fixed within 14 days.
What if you find no bug?
You get 100% of the package price back. A bug is a reproducible defect we show on a screenshot with steps to reproduce that gets in the way of your customer or you.
What access do you need?
Just the link to your app. If it cannot be used without a login, you add a test login to an encrypted field after payment. Do not send passwords of real customers or of the main admin.
Do you test on real data and with real payments?
Preferably on a test environment or with test accounts. We check payment with a test card in your payment provider’s test mode — we make no real payments and send no bulk e-mails.
What language is the report in?
The language you ordered in: English or Ukrainian.
How do I order and pay?
Press “Order”, paste the link to your app and sign in with Google or a code from an e-mail. Pay by card on WayForPay’s secure page at a fixed price. After payment a project chat with our team opens — we write the test plan ourselves.