Free first check for apps built with AI — Lovable, Bolt, Replit, Base44, v0, Cursor, Claude Code, Codex. Paste your app URL — the result is on screen in under a minute. No signup, no credit card.
is a local address. From here it points at our machine, not yours, so there is nothing for us to look at. Publish the app — one button on most of these platforms — and send us that URL instead. How to do that, and why a tunnel is riskier than it looks →
We only check what's publicly visible. We never store your data. The check is automated and the result appears on this page — usually in under a minute, no email required. Sending the URL means you accept our privacy policy.
Row-level security is off, or every policy says USING (true) — which means any logged-in user can read every row. Either way the table reads as protected and behaves as open.
Anyone can open DevTools and copy them. Gemini, Firebase, Supabase and Stripe keys are the most commonly leaked.
The sign-in flow works on the first try, so nobody checks it again. Meanwhile role checks live only in the UI, not on the server.
AI agents have deleted production databases and then reported success. Without verified restores, one bad prompt ends the business.
Timeouts, missing rate limits, no debouncing. Works perfectly in a demo, dies on launch day.
No error logging, no alerts. The first signal that something broke is an angry email.
Most agencies in this space quote "on request". We don't.
Agencies quote $3,000–15,000 for this work. Freelancers start at $299 and give you no report and no date.
Prices exclude VAT where applicable. Payment by card (Stripe) or bank transfer. Invoices issued by KHALAQ PORTAL EST, UAE.
Tell us what happened. We reply within 4 hours during business hours (GMT+8).
free, no signup — the automated check runs in your browser and shows the result in under a minute
20-minute call, we confirm the price before anything starts
within the turnaround time of your package above, sending a daily one-line update until it lands
findings, fixes, evidence, signed and dated
You will know the exact date your report lands before you pay anything.
If an independent security review finds a critical issue we marked as resolved, we fix it at no cost and refund the package price. Valid for 90 days after delivery.
Applies to components in the agreed scope only; does not cover code changed after delivery, or vulnerabilities in the platforms themselves.
For the free first check, no — just a URL. For an audit, read-only access to your project. We sign an NDA before anything.
The list itself is public: read all 41 points before you talk to anyone about this work.
Eleven short questions in three steps, so we know where to look first. We reply within one business day.
Three short steps: who you are, what the app is, and what you need from us. Only your name and email are required.
