The work
The report on it, in full
Every finding written the way yours would be, nothing blurred out, including the parts the read could not reach.
Production Risk Audit
Find out what would hurt you first.
One fixed-scope read of your repository and your running app, run against a published method rather than somebody’s memory of one. Every finding lands ranked by cost to you, with the evidence and a prompt you can paste into the tool that built it. I’ve built and operated web products for 13 years, and I sign the report that reaches you. €350, 48 hours, nothing else added.
- Price
- €350 + VAT
- Turnaround
- 48h from the scheduled start
- Access
- read-only, deleted after delivery
What you get
A written report a non-technical founder can read.
Each finding gets about a page, so the report is as long as the number of findings makes it.
One page per finding, always the same shape
The evidence it was found from, the business consequence if it triggers, the fix, a prompt for Cursor, Lovable or Claude, and a line telling you how to verify the fix took.
A severity count, not a score
You will know “14 findings: 3 critical, 5 high”, never a 7 out of 10.
The supply-chain picture
The packages your app pulls in: which are known-vulnerable, unmaintained or abandoned.
What I could not see
The explicit limits of this audit, named in the report, so you know which risks remain unmeasured.
A 30-day priority order
What to fix first, what can wait — so the report reads as a plan, not a scare.
An optional 15-minute debrief
The written report stands alone. If you want to walk through it, 15 minutes of my time are included at your request.
How it is made
A machine reads it. A person signs it.
The pass is automated. A published method walks your repository through seven domains and a named list of failure patterns, and returns each finding with the file and the line it came from. The same program ran on the specimen you can read, so what you are judging is the thing you would receive.
What a program cannot do is know your business. It cannot weigh a broken permission against a missing backup for your situation, separate a real finding from a plausible one, or decide what you should do first. That is the part I do before the report reaches you, and it is why the report is signed.
The Review above it is different work. It tests the running system and asks you what the business actually depends on, and it is done by hand.
From the report
One finding, exactly as delivered.
Finding IP-01 from the demo audit, condensed to fit a web page.
Criticalfinding 1 of 33 · demo audit
The database master key is compiled into the app every visitor downloads.
What I saw
src/lib/supabase.ts:5— the Supabase service-role key, read into browser codedist/assets/index-*.js:95— confirmed in the built bundle served to every visitor"role":"service_role"— decoded from the token itself, valid until 2034
What it costs you if it triggers
Anyone who opens the site and presses F12 gets unrestricted read and write access to the whole database: every customer, every invoice, every account. No login, no exploit, no skill. And because the key is already published, you cannot know whether it has been taken — it has to be treated as compromised.
How to fix it
Rotate the key first; the published one is burned, and code changes are worthless while it still works. Then delete the browser-side admin client and move the four privileged operations behind server endpoints that check who is calling.
Paste-ready prompt
In this Vite + React + Supabase project, the Supabase service-role key is being exposed to the browser. Fix it as follows, and do not preserve any browser-side path to the service role. 1. In src/lib/supabase.ts, delete the supabaseServiceKey constant and the exported supabaseAdmin client…
After the AI applies it, check: rebuild, search the new bundle for the old key — it must be gone, and the app must still load on the anon key alone.
What we check
What the read covers.
The audit reads across seven domains: data exposure · identity and authorisation · code, dependencies and supply chain · architecture and ownership · infrastructure and deploy · observability · AI change governance.
Inside them, five flaws get checked by name: hardcoded keys · RLS disabled · missing input validation · broken auth logic · console and data leakage. The checks know the tools’ habits — auth UI with no backend enforcement is a classic.
The read happens twice: once through the code and configuration, once through the running app as an ordinary visitor meets it. The findings that matter are usually in the disagreement — a screen that says you cannot do something, and a request that lets you anyway.
What each domain means, and where the scope stops, is public: see what we check.
What this is not
What this audit does not do.
Not a verdict
No ready/not-ready, no readiness score. Findings inform the launch decision; they do not make it for you.
Not a penetration test
And not a security certification, a compliance opinion or legal advice.
No intrusive testing
Nothing is exploited, no load is generated, no production data is touched. The pass reads code and configuration; where the running app is looked at, it is looked at the way any user would.
Not exhaustive
No audit is. Anything not examined is named in the report.
No fixes performed
Findings arrive with fix instructions and prompts. Having them applied for you is a different job, quoted separately.
If you need a verdict
Some launches need a verdict.
The audit reads your code and configuration; the Review tests your system and talks to your business. Reading finds the flaws; a ready-or-not answer takes the deeper work, and that answer belongs to the Review.
Step 1
Production Risk Audit — €350
Ranked findings, fixes and prompts, 48 hours from the scheduled start. The product this page describes.
Step 2 · if you need a verdict
Production Readiness Review — from €1,800 + VAT
Your system tested, your business in the room, a written ready-or-not answer at the end. The €350 credits in full against a Review bought within 30 days. See what the Review answers.
The alternatives
Start with the free options.
Seriously — run them.
| Ask Claude or Cursor | A $199 scanner | This audit | |
|---|---|---|---|
| Who reads the code | The tool that wrote it | Pattern signatures | A published method that didn’t, and an engineer who signs it |
| What it finds | Real flaws — run it, it’s free | Known signatures, at speed | The five flaws, plus what patterns can’t see: your architecture, your auth logic |
| Business consequence | Not weighed | Not weighed | Attached to every finding |
| The incentive | Free | Wants the subscription renewed | Paid once; only has to be worth its price |
Run the free one before you buy anything — the exact prompt is here. Just remember what it is: the author of the code, marking its own work.
Who it fits
One app, one repo, one price.
- One application, one repository — or one platform project.
- Built by a small team on a managed platform: Vercel, Supabase, Firebase, Railway or similar.
- Shared the way your platform already supports: a GitHub or GitLab read-only invite, a Lovable, Bolt or Replit project share, or a ZIP.
- Written authorisation from someone entitled to give it.
Multiple services, custom infrastructure, or a codebase a senior engineer cannot read in the allotted hours — that is bigger than this audit, and the fit check catches it before you pay. The Review is where those go.
How it works
No call. No proposal deck.
- 01
The fit form
written, no callStage, users and revenue today, platform and stack, a repository or project link, and confirmation you are authorised to share it. Written answers, about five minutes.
- 02
Fit confirmed
before any paymentI check the app sits inside the audit’s bounds and propose a start date. If it needs more than this audit, you hear that instead of a payment link.
- 03
Payment
€350 + VATUpfront, once the fit is confirmed. You already know the start date.
- 04
Access granted and verified
read-onlyA GitHub or GitLab invite, a platform project share, or a ZIP — I confirm it opens before the start slot arrives.
- 05
The scheduled start
the clock starts hereAccess is in hand, the slot arrives, and the pass runs against your code.
- 06
The report
within 48 hoursWritten, severity-ranked, with fixes, prompts and the 30-day order.
- 07
The debrief
15 minutes, if you want itThe report stands alone; the call is for walking through it together.
The clock runs from the scheduled start because a 48-hour promise is only worth making once access works and the slot is real. Both are settled before you pay.
Price
€350
plus VAT · fixed price · no upsell
€430.50 including VAT. EU businesses with a valid VAT number pay €350 — reverse charge.
There is another way to find out what is wrong with your app: the first incident, and the rewrite it forces.
Nothing wasted
100% creditable against a full Production Readiness Review within 30 days.
If the launch needs the deeper engagement, read what the Review does.
7-day money-back
If the report doesn’t give you anything actionable, reply within 7 days and I’ll refund you. No forms, no questions.
Confidentiality
Your code stays yours.
- Access is read-only and used for nothing else.
- Code and credentials are deleted after delivery.
- Anonymised finding statistics are retained only with written permission — the permission line lives in the authorisation form, not in fine print.
- NDA available on request.
- No trackers on this site beyond privacy-friendly analytics. No sponsored anything.
Check my work
Verify before you buy.
You are about to pay a stranger with no face on their website. Everything I would use to argue I am worth it is published, and why there is no name on it is answered plainly, with an offer if it matters to you.
The standard
What I check, published
The seven domains, the five flaws named, the point where the scope stops, and the commitments your code is handled under.
Questions
Asked before buying.
Lovable says security is built in. Isn’t that enough?
The platform layer is real: managed auth, sensible defaults, RLS available. What it cannot secure is the code generated on top of it — your access rules, your API routes, your auth logic. That generated layer is where the five flaws live, and it is the layer this audit reads.
Do you fix the findings too?
No. Every finding ships with fix instructions and a paste-ready prompt, so most fixes go through the tools that built the app. If you want them done for you, that is a separate, scoped engagement, quoted after the report exists — bundling fixes into an audit would pay me to find problems.
Is my code safe with you?
The commitments above are the whole answer: read-only access used for nothing else, deletion after delivery, an NDA on request.
I don’t really think of myself as a developer. Is this for me?
Yes. The report is written for the person who built the app with AI tools: findings in plain English, consequences in business terms, and fixes as prompts for the tools you already use.
What if the report gives me nothing useful?
Then the guarantee applies: reply within seven days and I’ll refund you.
Is 48 hours real?
Yes — counted from the scheduled start, not from payment.
Start here
Ready when you are.
Five questions to start. Everything after them happens on a schedule you agreed first.