Security audit for apps built with AI
Find out what a stranger can do to your app before you launch.
We check your live app and your GitHub repo the way an outsider would, read-only. Every problem comes with the evidence, a plain-English explanation, and a fix you can paste into your AI.
Made for apps built with Lovable, Bolt, Cursor, Replit and v0, running on Supabase or Firebase, with Stripe and AI APIs.
Anyone can read your profiles table without logging in
Your Supabase public key is in your website's code (that's normal). But this table has no rule stopping a stranger from reading it.
What we sent GET /rest/v1/profiles?select=*&limit=1 What came back 200 OK · 1 row returned Columns exposed id, email, full_name, stripe_customer_id What we kept column names and a count. never your users' data
Fix: turn on row level security for profiles and add a policy so each user only reads their own row. Copy-paste prompt included.
Why this matters
The bugs that hurt don't crash your app. They just sit there.
Lovable showcase apps let anyone read their database, including emails and payment details.
CVE-2025-48757 · Semafor, May 2025API tokens exposed by one AI-built app: a Supabase key in the browser and no database rules. Found within minutes.
Wiz research · Feb 2026is what an AI review often says. A security advisor checks a setting is switched on, not that your data is actually private.
Why "RLS on" isn't enoughWhat we check
We test what a stranger could actually do, and we tell you what we didn't test.
Each finding is marked with how we know. Proven means we demonstrated it on your live app, read-only.
- ProvenDatabase tables anyone can readSupabase tables and Firebase Realtime Database paths readable with no login.
- ProvenAI endpoints that run your bill for strangersWe send a few short test prompts to see if anyone can use your AI on your dime.
- ProvenSecret keys in your live website codeSupabase service keys, Stripe secret keys and AI provider keys shipped to every visitor's browser.
- From your codeWeak database rules and payment gapsRisky policies in your migrations, Stripe webhooks that don't check signatures, secrets committed to your repo.
- From your codeVulnerable packages you actually useKnown-vulnerable dependencies, checked against what your code imports.
- BasicsExposed files and admin pagesPublic .env or .git, debug pages, open admin panels, missing security headers.
What we don't check (yet)
- Whether one logged-in user can read another user's data. Coming soon, behind a proper ownership check.
- Self-hosted Supabase, mobile apps, and business-logic bugs.
- Secrets that were deleted from your repo in older commits.
- Anything that needs us to log in or change your data. We never do that.
Every report repeats this list for your app, so a clean result never means more than it should. The full list
How it works
Minutes, not days.
Paste your URL, connect GitHub
Pick the repos you want checked. It can read the code in the repos you pick. Audits never change your code.
We check it, read-only
Your live app and your code, together. When both show the same problem, we say so: that's the strongest evidence there is.
Fix it, then re-check free
Plain-English steps and paste-ready prompts for your AI tool. Re-run the audit as often as you like for 30 days.
What you get
Two reports. One for you, one to hand to whoever fixes it.
Hiring a developer to fix things? Send them the summary to get a quote, without sending your secrets.
The full audit
- Every finding with its evidence and how we know
- Fix steps and copy-paste prompts for Cursor, Lovable or Claude
- What changed since your last check: fixed, still open, new
- What we didn't check, for your app specifically
The summary
- What kind of work needs doing and roughly how big
- No exploit details, no table names, no keys
- Enough for a developer to quote, not enough for anyone to attack
How we stay safe
We test like a stranger. We behave like a guest.
We never change or delete anything in your app or database. Our only messages are a few short test prompts to AI endpoints, to prove whether strangers can use them. If your app saves chat history, they'll appear there.
When a table is exposed, we record its column names and a count. Never the values.
About one request a second, at most 50 per check, and we back off the moment your app struggles.
Every request says it's from SecureIndie, so your logs show exactly what we did and when. Seeing our traffic?
We copy your repo to a temporary folder, scan it, and delete it when the check finishes.
You confirm you own the app or have permission before every audit.
We publish how often we're right.
On gapbench, a public set of deliberately vulnerable apps, our free check caught 8 of 10 planted problems and raised 0 false alarms on 4 clean apps (September 2026). Almost no one in this space publishes theirs. We'll keep updating them, including the misses. How we measured it
Method: one live pass over all 14 gapbench apps with the free check only (no database or AI tests), at about one request a second.
Pricing
Pay once for an audit. Subscribe only if you ship every week.
Quick check
- Your live site's basics: exposed files, keys in your live site's code, headers
- Tells you what looks wrong
No database or AI checks. No proof or fix prompts.
Audit
- Live app and GitHub repo, checked together
- Proof for every problem we can demonstrate
- Fix steps and paste-ready AI prompts
- Full report + contractor summary (PDF)
- 30 days of free re-checks while you fix
Refund if we can't reach your app. Payments by Stripe.
Pro
- Unlimited audits and re-checks
- A check on every deploy and pull request (GitHub)
- Daily monitoring of your live app
- Cancel any time — email hello@secureindie.com
Billed monthly by Stripe.
For context: human security reviews of AI-built apps typically start around $199, and a security contractor usually charges more than $49 for an hour.
Already bought? Sign in.
Questions
The things people ask before they buy.
Lovable and Supabase already have a free security check. Why pay?
Those check that a setting is switched on. A table can have row level security on and still let anyone read it. We check whether a stranger can actually get your data, and we check your code and live app together.
Can't I just ask Claude or ChatGPT to review my code?
You should, and our report gives you prompts to do exactly that. But an AI review reads code and guesses. We test your running app and show you the evidence.
Will this break my app or mess up my data?
No. We read at about one request a second, and we never change or delete your data. Our only messages are a few short test prompts to AI endpoints, to prove whether strangers can use them. If your app saves chat history, they'll appear there. You'll see our requests in your logs, labelled SecureIndie.
Is your tool vibe-coded too?
Judge it by its evidence, not its origins: every finding shows the exact request and response, we publish our accuracy numbers including the misses, and our method is public. We'd rather show our work than ask you to trust us.
What if you find nothing?
Then you get a report that says what we checked, what we didn't, and that we found no problems in what we checked. That's useful to show a client or investor.
Do I need to be technical?
No. Every finding is in plain English with a fix you can paste into your AI tool. If you'd rather hire someone, send them the summary.
Launch knowing what a stranger can and can't do.
One payment. Evidence for every problem. 30 days to fix and re-check.
Audit my app — $49