Your AI wrote the code. Now let a human read it.

Do, and I will even give you the prompt. You will get a long list. What your AI cannot do is tell you which items are real, prove them against your live app, see your database and hosting settings, or check that its own fixes worked. If you cannot read code, that is the part you cannot do yourself either. It is what you pay me for.

Yes, that is exactly who it is for. If you built an app with AI and cannot tell whether the code is any good, I check it and explain what matters in plain English. You never need to understand the code to act on the report: every problem comes with a prompt you paste into your AI tool. And you do not need to know what to ask. The report answers the questions you would have asked if you knew how.

Most AI builders can push your app to GitHub, a free site that stores code. You invite me to it with read-only access, which means I can look but not change anything. Never done it? After you book, I send you step-by-step instructions for your tool. A zip file works too. When the report is delivered, remove my access again; I remind you.

Every booking comes with an NDA, automatically. I never sell, publish or pass on your code. The only other party that sees it is the AI provider that helps with the first pass, under terms that do not allow it to train on your code. I never need your passwords or your live database, and I delete my copy within 7 days of delivering the final report.

Maybe. It is one of the most common problems in AI-built apps: in 2026 UpGuard found 16,326 Supabase databases with tables anyone could read. If you want an answer today, run the free self-check; it tells you what to ask your AI. The Safety Scan gives you a human answer within 2 business days, with proof: I sign up two test accounts and show whether one can see the other. No alarm, no blame. I tell you what it means and what to do first.

No. These problems are normal in AI-built apps, including ones built by experienced developers, because the tools tend to skip the same things. The report is about the code, never about you. "Slop" is what the AI left behind, not what you are. Nobody else sees the report unless you share it.

Then you are in the best possible place: you know, and you know what to do first. The report gives you a calm fix order, a prompt for each problem, and a free follow-up check once you have fixed them. If you would rather not touch it, I fix things by the hour or in the Fix Pack. Nothing goes public, and I never change or delete your users’ data. Often even a "terrible" problem is a small fix once someone has pointed at the right line.

No. Fixed prices, paid once. There is no call unless your tier includes one, and no upsell during the review. If your app is bigger than the tier covers, I tell you before I start and you choose: upgrade, narrow it down, or a full refund. Anything extra, like the Launch Review size add-on or fixing by the hour, is told to you first and is your decision.

Three things, and the instructions I email you cover all of them. Your code (GitHub or a zip). Your app’s address and a way in: open sign-up, or two test accounts you create for me, plus which hosting plan you are on. And your database rules: Lovable and Bolt usually put them in the repo already; otherwise I show you how to export them in two minutes. No passwords, ever. If you get stuck on any step, reply and I help.

Run it first. Built-in scans and automated pentests are cheap or free and catch real problems; Lovable even sells an automated pentest for $100. What they give you is a list. For $199, a person spends one to two hours on your app: I read your code as a whole, decide which problems matter for your app, prove the critical ones, write a fix prompt for your tool, check the fixes afterwards, and answer your questions by email. If you only need a list, the automated one is a fine start.

For every critical problem, I show that it really works: for example, I sign up two test accounts and show that one can read the other’s data. You get the steps and a screenshot. The tests are manual and low-volume: no load tests, no attack tools, nothing aimed at your hosting provider. I never change or delete your users’ data, and you give me permission when you book. If your hosting plan does not allow security testing (Vercel’s free Hobby plan, for example), I prove the problem on a preview copy of your app instead.

A PDF by email that looks like the sample report: a diagnosis, the problems in fix order, each with the file and line, what can go wrong in plain English, and a prompt for your AI tool. Then you can ask me questions by email: 7 days after a Safety Scan, 30 after a Launch Review or Fix Pack. The Launch Review also has a 30-minute video call, on weekdays between 2 pm and 8 pm Swiss time (8 am to 2 pm New York). Everything is in English, or German if you prefer.

Fix the problems from your report, with your AI tool or however you like, then reply to my email within 30 days and give me access again. For the Safety Scan I re-check the problems in your report; for the Launch Review and Fix Pack, everything in it. I check in the code, and again on your live app where I proved the problem there, and you get my answer within 2 business days. AI tools often say "fixed" when it is not. It is one check, not a second review: new features or new code are a new check-up.

Apps written in JavaScript or TypeScript: React, Next.js, Node.js, Express, Supabase, Firebase and friends. That is what Lovable, Bolt and v0 produce, and what Replit, Cursor and Claude Code usually write for a web app. A mobile app built with Expo or React Native is fine when it shares the same backend; I test it through the web and the backend, not on a phone. If your app’s backend is Python (some Replit apps), PHP or something else, I am the wrong person and I say so before you pay. A vibe-coded app, by the way, just means one written mostly by AI, where nobody has read every line. That is how a lot of good products start.

That is normal, and you never have to count anything. Pick the review that fits your budget; I measure your app before I start and tell you. If it is bigger than the tier covers, you choose: upgrade, narrow it down, or a full refund. The Safety Scan’s price counts toward a Launch Review or Fix Pack within 30 days, so starting small costs nothing. "Lines of your code" means the code you and your AI wrote, not the packages and UI kit your tool installed, so many Lovable, Bolt and v0 apps fit the Safety Scan. "One app" means one product: its code and the one database project behind it. A second product or a second database project is a second booking. Bigger than 30k lines? The Launch Review covers up to 50k for $299 more; I tell you before I start.

Safety Scan within 2 business days, Launch Review within 4, Fix Pack within 5. The clock starts when I can see your code. I take only a few reviews a week, so each one gets my full attention; the booking page shows when yours can start.

If you want me to, yes. The Fix Pack is a Safety Scan plus up to 6 hours of me fixing the top problems. After the scan I send you the fix list with my time estimate, and I change nothing until you approve it. Every change comes as a pull request on GitHub with a plain-English note on how to test it, and nothing goes live until you accept it. If 6 hours are not enough, I stop, tell you what is left and how long it takes, and only carry on if you say yes, by the hour in blocks you approve. Only need two things fixed? After any scan I fix by the hour at $199, three hours minimum, with the list agreed before I start. Otherwise, every report comes with a prompt for each problem so your AI tool can do the fixing.

Then you do not pay. If your Safety Scan report has no problem rated medium or higher, I refund the full price automatically. Medium means a real weakness that could cost you data, money or users if someone went looking; low means tidy-up that can wait. For the Launch Review and Fix Pack, you get a full refund any time before I start.

A fixed price, paid upfront by card through a secure Stripe checkout. Need an invoice for your company? Mention it in the booking form. While they last, the first 10 Safety Scans cost $149 instead of $199; the booking page shows how many are left, and that counter is real. In return I ask whether I may quote you afterwards; you see the wording first, can say no and keep the price.