AI-built app review
Find out what's risky in the app your team built with AI.
For owners whose business now runs on an app someone built with AI tools, or inherited from someone who left, and nobody can say what's holding it together.
$1,500 · 3 weeks · fixed scope
Reviews run remotely, wherever you are. In person in Sacramento, Stockton and Modesto if you'd rather. You work with me directly, not a ticket queue.
The point of the review
Questions a scanner can't answer
- Can the business depend on this app day to day?
- What breaks first as more people use it?
- Who owns the data, and is anything backing it up?
- Could another engineer pick it up and maintain it?
- Should you fix it, rebuild it, or replace it with off-the-shelf software?
What I check
- Secrets in the source code and the repository history
- Sign-in, permissions, and who can reach what
- How customer and business data is stored and handled
- Dependencies and how out of date they are
- Backups, deploys, and what happens when something fails
Automated scanning included.
What you get
- A written report in plain language that you keep
- Fixes in priority order, with what each one protects
- A call to walk through the findings together
- When fixing is the right call, a fixed quote to fix the top items
What it isn't
- It isn't a penetration test. I review the code and configuration; I don't attack the running system.
- It isn't the fixes. You get the list and, if you want it, a quote. The work itself is separate.
How it starts
Book a call or send a message. We confirm the app fits the scope below.
You grant read access and we do a 30-minute walkthrough of how the app is used.
You get the report within 3 weeks, then we go through it on a call.
Scope
- One codebase, one production deployment, one database, a single tenant, and up to 3 third-party integrations. Anything larger gets a quote instead.
- What I need from you: read access to the repository, read access to the hosting console, and a 30-minute walkthrough.
- The turnaround starts on the agreed start date, once access works and the walkthrough is done. Incomplete access delays the start.
- Anything urgent, like a live exposed secret or open admin access, is reported the same day I find it.
- Anything the access doesn't reach is listed in the report as not verified.
- I take 2 reviews a month. Ask about the next available start. A booked call or message confirms fit and timing; it doesn't reserve a slot.
If you sign a scope for a fix or an automation sprint within 30 days of the report, the review fee is credited toward it, up to that work's price. The work can start later. Unused credit isn't paid out.
FAQ
Common questions
Does it matter which AI tool built the app?
No. Lovable, Bolt, Replit, Cursor, ChatGPT, or a contractor who leaned on one of them: the review looks at what was built, not how. Apps you inherited from someone else qualify too.
Is this a security audit or a penetration test?
It's a code and configuration review. Automated scanning is included, but the value is a senior engineer reading the code and telling you what matters. It doesn't replace a penetration test if your industry requires one.
What happens after the review?
You keep the report whatever you decide. If fixing is the right call, I give you a fixed quote for the top items. If you sign a scope for a fix or an automation sprint within 30 days of the report, the review fee is credited toward it, up to that work's price. The work can start later. Unused credit isn't paid out.
Do I still need a paid discovery?
Not for this app. For a single AI-built app, the review takes the place of discovery: it's the written plan you'd otherwise pay for.
Not sure it's safe to keep running?
Tell me what the app does and who built it. I'll tell you whether the review fits, or what would fit better.