Skip to content

Security review for AI-built apps

A security review for apps built with Lovable, Bolt, Replit, v0 or Cursor, often on Supabase. I find and fix common problems in the areas we agree, then write up what I found and what I changed in plain English.

£595 inc. VAT. All prices include VAT.

Fixed price

Security review and fixes

The scope is agreed with you before I start.

£595 inc. VAT

  • Row-level security, exposed keys, sign-in, storage and server functions
  • A written report of what I found and what I changed
  • Fixes in those areas, up to 6 hours; anything bigger is quoted first

Typically within a week of access. It depends on the app.

Tell me about your app

An enquiry only. Nothing is ordered or paid for on this page.

Who it’s for

Founders and small businesses with an app they have not had checked

Your app was built with Lovable, Bolt, Replit, v0 or Cursor, often on Supabase. It runs, and people can use it. What you do not know is whether the database rules, the keys and the sign-in were set up properly, or what is left to finish before more customers arrive.

A documented example

In March 2025 a researcher scanned 1,645 apps on Lovable’s own showcase and found 170 of them (about 10%) had row-level security problems that let anyone read or write their database tables (CVE-2025-48757). Lovable disputes the CVE, on the grounds that each app’s owner is responsible for protecting its data. That was one sample, from one platform, in 2025. Your app may be better or worse, which is why a review checks it directly.

Source: The researcher’s write-up(opens in a new tab) · The NVD record, including the dispute(opens in a new tab)

Row-level security is the Supabase setting that decides which rows of a table each user may read or change. An app’s public key is visible in the browser by design, so these rules are what stand between that key and your data. If they are missing or wrong, the table can be open to anyone.

What the review covers

Five areas. You get a written report of what I found and what I changed.

Database access rules Supabase row-level security
Which tables someone who is not logged in, or the wrong user, can read or change.
Exposed keys and secrets Code, repository and browser
Private keys and passwords left where they can be found.
Login and sign-in Auth
How people sign up, sign in and reset a password, and whether private pages stay private.
File storage Buckets and uploads
Who can see, upload or delete the files your users store.
Server functions Code that runs on your server
Whether that code checks who is asking before it acts.

Not included

  • Areas not named above.
  • Fix work beyond 6 hours. Anything bigger is quoted first, in writing, before I start it.
  • Finishing work, such as missing features, bugs and launch preparation. That is quoted separately.
  • Checking the app again after later changes to the code.

What to know before you ask

  • No review can promise an app is secure. This one reduces the risk; it does not remove it.
  • It covers only the areas named above.
  • It needs your signed permission before I start. Nothing is tested before then.
  • It is a point-in-time review. Later code changes, including ones an AI tool makes for you, can undo it.

How it works

  1. Tell me about the app

    Use the short enquiry form below: what the app does, what it was built with and what worries you. Please do not send passwords, keys or access links.

  2. Agree the scope and sign

    We agree what is in scope, and you sign a short authorisation form.

  3. Give me access

    You give me access to the code repository and the project.

  4. Get the report and the fixes

    A written report of what I found and what I changed, plus the fixes. Typically within a week of access.

Nothing is tested before you’ve signed the authorisation.

If the app needs finishing too

£595 inc. VAT covers the review, the report and the fixes described above. Finishing work beyond that is quoted separately, in writing, before I start it. Bookings, web apps and automations are priced from £995 (Founding special for the first 5 bookings and apps projects, then from £1,495). All prices include VAT. See the pricing.

Who does the work

I have worked in web and digital for 20+ years, and freelance for the last 6, building 30+ sites. I also build full apps with AI coding agents myself. Everything is done remotely. About me.

Independent. Not affiliated with or endorsed by Lovable, Bolt, Replit, Vercel, Cursor or Supabase.

Straight answers

Will you tell me my app is secure?
No. No review can promise that. I tell you what I found and what I changed, in the areas we agreed, so you know where you stand on the day I looked.
Is £595 the whole price?
£595 inc. VAT covers the review, the written report and fixes in the agreed areas, up to 6 hours of fix work. Anything bigger is quoted first, in writing, before I start it.
How long does it take?
Typically within a week of access. It depends on the size of the app, and I will say so if yours looks bigger.
What if my app is not on Supabase?
The review is built around Supabase. If you use something else, say so in the enquiry and I will tell you whether I can take it on.
I only have a simple website, with no logins or database. Is this for me?
Probably not. This review is for apps where people sign in and data is stored. For a simple DIY or AI-built site, the £149 “Own it” fix-up on the pricing page may be all you need.

Tell me about your app.

This starts an enquiry. I reply within one working day, we agree the scope, and you sign the authorisation before anything is tested.

£595 inc. VAT. All prices include VAT. How I use your details is in the privacy policy.

Enquiry: security review

I reply to this address.

So I know which app you mean. Nothing is tested from this form.

What it does, what it was built with (Lovable, Bolt, Replit, v0 or Cursor; Supabase or something else) and what worries you. Please don’t include passwords, keys or access links.

This is an enquiry only. Nothing is ordered or paid for here, and I reply within one working day.

I’m Mike Latal, and I use these details only to reply to your enquiry. The privacy policy says how long I keep them and what your rights are. Prefer email? Write to mike@mikewebdeveloper.co.uk.