For people who shipped something real
You built an app with AI and it works. But “it works” and “it’s safe” are different tests — and only one of them has been run.
13 questions. No scanning, no signup to see your score.
The uncomfortable part
Not hypothetically. Public incidents keep following the same script — and none of them took a genius to exploit. All of them took under an hour to prevent.
July 2025
Firebase storage bucket left open with directory listing on.
~72,000 images leaked — including 13,000 selfies and government IDs — then 1.1 million private messages in a second breach days later.
“Default storage settings are not security settings.”
Reported by Engadget ↗March 2025 · CVE-2025-48757
Missing Row Level Security in AI-generated Supabase backends.
A scan of 1,645 showcase apps found 1 in 10 exposing user data: names, emails, financial records, API keys. One app alone exposed 18,000 users.
“The AI writes the query. It does not ask who is allowed to run it.”
Reported by Superblocks ↗March 2025
“Zero hand-written code” SaaS with API keys in the frontend and no rate limiting.
Subscriptions bypassed, keys maxed out, data manipulated. Shut down within a week of the viral launch post.
“A paywall the server never checks is a suggestion, not a paywall.”
Reported by Pivot to AI ↗July 2025
Auth bypass on the platform itself: a public app_id was enough to mint a verified account.
Private enterprise apps — HR tools, internal chatbots — open to anyone, SSO bypassed. Found by Wiz researchers; patched in 24 hours.
“Even the platform under your app is somebody’s first draft.”
Reported by Wiz Research ↗How it works
13 questions about your stack — Supabase, Firebase, Next.js, or a managed builder like Lovable, Bolt, or Base44. Built with Claude or Cursor and not sure what's underneath? That's covered too — “I don’t know” is always an option. It’s the honest one.
0–100, with your top three gaps explained in plain language — free, on the spot, no email required to see your score.
The Sunday Sprint: checklists and lessons matched to your exact findings — including audit prompts you can hand straight to Cursor or Claude. $20, once.
Who this is for
You used Cursor, Lovable, Bolt, v0, or Claude to build something real — and real people are using it. You’re not trying to become a security engineer. You want to know the doors are locked and get back to building.
Who it’s not for
Security professionals — and apps with no users and no data. If nobody can be hurt, ship on, friend.