Row level security
Tables with no policy, or policies that let any signed-in user read every row.
PRODUCTION READINESS CHECK
Is your app ready for real users?
Paste a repository and get a ranked list of what will break first: open tables, leaked keys, unverified payments, roles the client can change. Built for apps made with Lovable, Bolt, Cursor and Next.js.
Free during early access · code analysed in memory, never stored
Check
Waiting for a repository0%
Readiness score58 / 100
What the check looks for
The six failures found most often in AI-built and fast-shipped applications, taken from real audits.
Tenant isolation
Paths where one customer can reach another customer's data through the API.
Exposed secrets
Service keys in the client bundle, committed .env files, keys in public routes.
Payments
Stripe webhooks without signature checks, missing idempotency, unhandled failed payments.
Roles and auth
Admin rights checked in the interface only, role claims the client can change.
Failure handling
Checkout and sign-up flows with no error handling, silent failures, no logging.
What you get back
A score per area and every finding with its file, its consequence and the fix. The sample is based on a real pre-launch audit, with names removed.
READINESS REPORT · SAMPLE
acme/marketplace
58out of 100
Access control34
Secrets and config52
Payments61
Auth and roles70
Error handling78
- CriticalTables readable by any signed-in user
supabase/migrations/0007_policies.sqlImpact Any customer can read every other customer's orders and addresses through the public API.
Fix Replace the 14 permissive policies with owner-scoped policies and add a cross-tenant read test per table.
- HighWebhook accepted without signature check
app/api/stripe/webhook/route.tsImpact A forged request can mark an order as paid.
Fix Verify the Stripe-Signature header with the endpoint secret before processing the event.
- MediumNo idempotency on payment events
lib/payments/handleEvent.tsImpact Stripe retries create duplicate credit top-ups.
Fix Store processed event IDs and skip repeats.
How it works
- 1
Paste a repository
Public GitHub link or a zip. The key files are read, the rest is ignored.
- 2
Get the report
Findings ranked by severity, each with the file and the fix, in a few minutes.
- 3
Fix or hand over
Fix it with your own team, or book a full audit and I go through the code by hand.
When you need more than a scan
Full audits done by hand. Fixed price, written pack.
Readiness audit
For an existing codebase before launch or handover. API contract and roles first, then the live interface module by module, then the code against that contract. Every finding carries a severity grade, a file reference, the release consequence and an hours estimate. Conclusions that do not hold under live verification are withdrawn, and the withdrawal is documented.
From $850 · 3 to 7 working days
Discovery audit
Before a rebuild or a new system. Source and data analysis, schema design, migration plan, then a milestone estimate with timeline. The pack stands on its own: a client who takes it to another developer has a working map of the project.
From $1,200 · 5 to 10 working days
Numbered documents in Word and Markdown, with an evidence bundle: checksums, test and build logs, screenshots, pinned to one commit.
Results from real audits
0cross-tenant reads
Access control rebuild, multi-tenant SaaS
Pre-launch audit found RLS policies that lived only in discarded migrations and never reached the database. Rebuilt access control around one permission matrix driving API guards, row level policies and tests: 31 tables under policy, 96 access tests.
82%of generated code kept
AI-generated app taken to production
Marketplace built in Lovable, preparing for national launch. 14 of 31 tables let any signed-in user read every row. Replaced the policies across all 31 and moved the role claim server-side. Ongoing technical ownership after the audit.
48 hassessment, then hired
48-hour assessment, then the build
Legal-readiness diagnostic built with AI tools, two weeks from a demo. Two developers, same packet, 48 hours. My harness found a false-green status, boundary defects and state leaks; recommended stabilise, not rebuild. Hired for the build, every defect proven by a failing test first.
9documents with evidence bundle
Release readiness audit, AI SaaS
AI business assistant before its first release. API contract and roles first, then the live interface, then the code: invitations, usage metering, backend role checks, OAuth tokens. Every finding graded with file, consequence and hours; unverified conclusions withdrawn.
529URLs in the redirect plan
Discovery audit, B2B catalogue rebuild
Multilingual industrial catalogue moving off a legacy CMS. Scraper source analysis, a Sanity schema that takes new manufacturers and languages, a translation test kit and a milestone estimate. The client built from the pack with another developer.
4,500records refreshed daily
Competition aggregator, technical lead
Architecture and scraping engine: NestJS cron pipelines with adapters for 6 operators, anomaly detection and webhook alerts. 4,563 images moved to Cloudflare R2 with content-hash deduplication, cutting card weight seven times.
Also
Valuation report automation, PropTech
Fixed-price scoping for a firm of chartered surveyors: report fields agreed, covered with the smallest set of licensed data APIs, then architecture, timeline and price for the build.
Consumer matching platform, 18 months
Technical lead on two products with paying users. Catalogue schema normalised and filtering moved to the server: listing endpoint from 39 MB to 16 KB. Migrated to the client's own infrastructure on handover.
Database migration, 4.8 million rows
67 tables mapped column by column, resumable batches, row counts and checksums before cutover. Twelve minutes of downtime, nothing lost.
Third-party API integration at volume
1.04 million calls a day across four providers, rate-limit pacing, backoff retries, an idempotency key on every call. 0.4% retried, zero duplicate writes.
Dashboards and reporting
B2B admin dashboard used daily by 20 people; a search rebuild took the median query from 4.1 s to 38 ms across 480,000 records. Scheduled PDF and CSV reporting, 42 runs, none missed. Kendo UI commercial licence.
Next.js performance rebuild
Performance pass on a client site: Lighthouse score from 54 to 98, page weight from 2.4 MB to 610 KB.
Who is behind it
Svitlana Horodylova
Senior full stack developer · Technical lead · UK
Based in East Sussex, working with clients in the UK, the US and Europe. Top Rated Plus on Upwork, 30 contracts (client reviews). Clients keep full ownership of everything I build: code, repository and accounts, from day one.
Before software: twenty years in editorial work and fifteen years leading teams, which is why every audit ends in a report a non-technical founder can act on.
Have an application to check or finish?
Send the repository link or a short description. I reply within one working day.