Lovable, Replit, and Bolt got your app shipped. They didn't check who can read your database, whether your checkout trusts a price sent by the browser, or what happens when a user asks to be deleted. I do, and I fix what I find.
An example of what my free query finds. It's read-only and runs on your own Supabase project in about a minute. Get the query
All four are things I check in every audit.
create policy "anon_write" on venues for insert to anon with check (true); create policy "anon_update" on venues for update to anon using (true);
name google_place_id reviews Xiangshan Trail ChIJ…7kQR 8,102 XiangShan Peak ChIJ…2mFa 1,455 Elephant Mountain ChIJ…9dVn 12,330
GET /rest/v1/orders?select=total,created_at 200 OK returned 1,000 rows rows actually in table: 14,207
auth_user | profile_rows | order_rows | files
--------- + ------------ + ---------- + -----
0 | 1 | 4 | 3
A free SQL query you paste into your Supabase SQL Editor. It lists every table, policy and storage rule that signed-out visitors can read or write, and it changes nothing.
Security first. Everything else I handle while I'm already in your codebase.
A severity-ranked report of what's exposed: access control, data anyone can read or overwrite, secrets in your client bundle, whether your checkout trusts a price sent by the browser, and what an attacker reaches after signing in.
I audit, then fix what I find and verify each fix holds. Work happens on a branch, never straight on production, and you get a written record of what changed. Quoted after the audit, so the number can't move on you.
Every new table, endpoint and integration adds surface. A monthly re-check as you ship catches problems before they become incidents.
The things expected of an app once it has real users, tested rather than assumed: that an account can actually be deleted, that unsubscribe works, that tracking waits for consent, and that your privacy policy matches what the code really does. What I check.
Supabase schema and RLS problems, queries that crawl at scale, and fixes that keep breaking something else. For apps built with Bolt, Lovable, Replit, Cursor or v0.
The failure that isn't in your code or your schema: data that was never collected. I work out what's missing and how badly it's skewing what your users see.
Deduplication and catalogue merges with every match scored by confidence, and near-ties handed to a person instead of guessed.
Model-driven workflows built to fail safely, with the malformed-output and timeout paths designed in rather than discovered later.
Read-only access is fine. A repo link, a project, or just a description of what's going wrong.
What's broken, how serious each item is, and what it costs to fix. This part is free.
A fixed price, agreed before any work starts. If the audit finds nothing worth paying for, I'll tell you that instead of inventing work.
The first report costs nothing and takes 48 hours.
Get a free auditFrom two years building production apps with AI agents, the same way most AI-built apps are made.
Critical
Security looked configured, and technically it was. Both write policies checked true, so the key in every visitor's browser had full write access. Nothing behaved strangely, because nobody had tried yet.
Measuring nothing
A rule meant to catch overrated tourist traps fired on 27% of real venues. The same rule flags 28% of pure random noise. I killed it rather than ship a number that only looked like a signal.
The finding was the failure
Matching 126 collected places against the live database recovered 63. The fix wasn't a better matcher. The database had never held those records, and the match rate was a map of what was missing.
I built production apps the same way you built yours: prompting agents, shipping fast, trusting output that looked right. Then I spent two years finding everything that method gets wrong. Every fault on this page came out of that.
No agency, no team, no account manager. You deal with the person doing the work. I'm in Taipei, so for most clients you describe the problem at the end of your day and the report is waiting at the start of the next.
Practical write-ups on the failures AI-built apps ship with, and how to check your own.
No call required. Describe the symptom in a couple of sentences and I'll tell you whether it's something I can help with.
Or email me directly at asad@auditmyapp.dev
Worried about giving access to your app? Here is how I handle access and data.