16,326
exposed databases
In September 2026, UpGuard researchers scanned about 300,000 domains and found over 16,000 Supabase databases answering requests from anyone. More than half contained personal data.
Source: UpGuard, via SaaSCitySecurity for AI-built apps
Your AI built the app. We make sure it isn’t leaking your users’ data.
Apps made with Lovable, Bolt, Replit, Cursor and v0 often go live with open databases, exposed keys and weak authentication. We find the problems and fix them for a fixed price. No rewrite, no lock-in.
- Read-only checks, only with your authorization
- Fixed prices, published below
- Your code and infrastructure stay in your accounts
The problem
This isn’t a hypothetical
RLS off
is why it happens
AI coding tools often create database tables without Row Level Security. With it off, the public key that ships in every app can read (and sometimes delete) every row.
98%
had at least one flaw
In one scan of 1,072 AI-built apps in production, 98% had at least one security flaw. It’s common, not rare.
Source: Symbiotic Security, via MediumMost founders find out when a user, a researcher or an attacker finds it first. The fix is usually small. Finding it is the hard part.
Scope
What we check and fix
You get a plain-English report: what was wrong, what we changed, and what to watch for next time you prompt your AI.
- Database access rules
- Row Level Security on every table, with policies that match who should see what. We don’t just switch it on and break your app.
- Exposed secrets
- Service keys, API tokens and credentials sitting in your frontend code or public repo. We rotate them and move them server-side.
- Authentication
- Sign-up, password reset, email verification and session handling, so no one can get into another user’s account.
- Payments and webhooks
- Stripe and other webhooks verified by signature, so fake “payment succeeded” events can’t unlock paid features.
- Storage
- Public buckets that should be private: user uploads, invoices, IDs.
- Backups and recovery
- Point-in-time backups on, and a tested restore, so one bad AI edit can’t wipe your data.
Stacks we work with
- Supabase
- Firebase
- Next.js
- React / Vite
- Node
- Vercel
- Netlify
- Cloudflare
Other stack? Ask. We’ll tell you honestly if it’s outside what we do.
Process
How it works
- 1
Free check (48 hours)
Send your app’s URL and confirm you’re authorized. We run read-only, non-destructive checks and email you the most serious issues we find.
- 2
Fix (3–5 business days)
You grant temporary access. We back up first, work in a separate branch or preview, and nothing reaches production without your OK.
- 3
Report + handover
You get the written report, and we remove our access, unless you choose ongoing protection.
Pricing
Fixed prices. Published up front.
Free Check
Anyone who wants to know where they stand
$0
- Read-only external check
- The top issues in writing within 48 hours
Security Fix
Launch priceApps about to launch or already with users
$490$990 one-time
For our first 5 projects, then $990.- Everything in “What we check and fix”
- One app, one production environment, up to 25 tables
- Plain-English report
- 14 days of follow-up questions
Book a Security Fix
Every Fix starts with the free check, so we can confirm scope and price before you pay anything.
Guard
Founders who keep building with AI after the fix
$149/month
- Weekly automated scans
- Review of every change your AI makes before it goes live
- Uptime and error monitoring
- Backup checks
- Priority fixes
Add after your Fix
Bigger app, more environments or a rebuild needed? We’ll quote a fixed price before starting. We don’t bill by the hour.
How we work
- A senior engineer does the work. Over 10 years of backend and frontend experience. Not a bot, and not a checklist handed to a junior.
- Your app stays yours. Code, database and hosting stay in your own accounts. We never move your data to ours.
- Authorized testing only. We only test apps you own or are authorized to test, and we confirm that in writing.
- Confidential by default. NDA available on request. Copies of your data are never kept. Temporary access is removed at handover.
- Registered company, with a contract and an invoice for every charge.
What this isn’t
- Not a formal penetration test or compliance certification (SOC 2, HIPAA, PCI). If you need one, we’ll tell you, and we can get your app ready for it.
- Not a guarantee that nothing can ever go wrong. No one can honestly promise that. We fix the known, common, high-impact problems, which are what attackers look for first.
- Not a rewrite. We fix what you have. If something truly can’t be saved, we’ll say so and quote it separately.
FAQ
Questions
Do you need access to my app for the free check?
No. The free check uses only your public URL, with your written authorization. The Security Fix needs temporary access to your repo and database.
Will you break my app?
We back up before touching anything, work in a separate branch or preview, and test the main flows with you before anything goes live.
I don’t know what stack I’m using.
That’s fine. Tell us which tool you built it with (Lovable, Bolt, Replit…) and we’ll figure out the rest.
How long does the fix take?
3–5 business days after we receive access, for apps within the standard scope.
Can I keep building with AI afterwards?
Yes. The report includes what to tell your AI so it doesn’t reintroduce the problems. Guard adds a review of every change.
What if you find nothing serious?
Great. You get that in writing, and you pay nothing for the check.
Do you work with apps outside the US?
Yes. We work remotely with founders anywhere. Communication in English, Portuguese or Japanese.
Find out before your users do.
Free, read-only, with your authorization. Results within 48 hours.
Free security check
Request your free check
Read-only and non-destructive. We look only at what’s publicly reachable, and email you the most serious issues within 48 hours.